Linux Network Namespaces with ip netns and veth Pairs

Network namespaces are the isolation primitive behind containers and network virtualization: each namespace gets its own interfaces, routing table, ARP table and firewall state. With ip netns and veth pairs you can build small virtual networks entirely in software - two namespaces chatting over a virtual cable, or several namespaces bridged like real hosts - which makes netns the perfect sandbox for testing routing, filtering and forwarding ideas without touching production. This guide builds both topologies step by step.

Creating Namespaces and a veth Pair

sudo ip netns add client
sudo ip netns add server
ip netns list

A veth pair is a virtual cable: packets entering one end come out the other. Create the pair, then move each end into its namespace:

sudo ip link add veth-client type veth peer name veth-server
sudo ip link set veth-client netns client
sudo ip link set veth-server netns server

Configuring the Point-to-Point Link

Bring up loopback and the veth end inside each namespace, assign addresses, and test:

sudo ip netns exec client ip link set lo up
sudo ip netns exec client ip link set veth-client up
sudo ip netns exec client ip addr add 10.10.10.1/24 dev veth-client

sudo ip netns exec server ip link set lo up
sudo ip netns exec server ip link set veth-server up
sudo ip netns exec server ip addr add 10.10.10.2/24 dev veth-server

sudo ip netns exec client ping 10.10.10.2

ip netns exec <ns> <command> runs any command inside the namespace - the same trick works for ip route, tcpdump or an application you want to isolate.

Connecting Namespaces Through a Bridge

To give many namespaces shared connectivity (the container-network model), create a Linux bridge in the default namespace and attach one end of each veth pair to it:

sudo ip netns add ns1
sudo ip netns add ns2
sudo ip link add br0 type bridge
sudo ip link set br0 up

sudo ip link add veth1 type veth peer name br-veth1
sudo ip link set veth1 netns ns1
sudo ip link set br-veth1 master br0
sudo ip link set br-veth1 up

sudo ip link add veth2 type veth peer name br-veth2
sudo ip link set veth2 netns ns2
sudo ip link set br-veth2 master br0
sudo ip link set br-veth2 up

sudo ip netns exec ns1 ip addr add 10.10.10.1/24 dev veth1
sudo ip netns exec ns1 ip link set veth1 up
sudo ip netns exec ns2 ip addr add 10.10.10.2/24 dev veth2
sudo ip netns exec ns2 ip link set veth2 up

Give the bridge itself an address in the same subnet if the namespaces must also reach the host, and note that the bridge approach is exactly what Docker and Open vSwitch automate - our Docker networking drivers guide shows the production version of this pattern.

Use Cases and Cleanup

• Test routing policies safely - combine namespaces with ip rule policy routing to verify table selection before production.
• Simulate multi-host topologies on one machine for OSPF/BGP labs.
• Sandbox firewalls (nftables rules per namespace) and traffic-shaping experiments.
• Understand containers: a container is mostly a set of namespaces - see Docker's bridge/macvlan drivers and 802.1Q VLAN tagging for the tagging angle when namespaces need VLAN separation.

sudo ip netns exec ns1 ip link del veth1     # deleting one end removes the pair
sudo ip netns del ns1
sudo ip link del br0

原文链接：https://www.redhat.com/en/blog/net-namespaces