A practice network inside the machine

The client and the server from the first exercise are two isolated networks inside one machine, and you run commands in them with ip -n and ip netns exec.

Apart from lo, the practice machine has no interfaces: it is cut off from outside networks. Preparation creates the client and the server as network namespaces: separate sets of interfaces, addresses and routes inside one kernel. A program in the lab-client namespace sees only that namespace's interfaces.

The namespaces are joined by a veth pair: two virtual interfaces that work like the two ends of a cable, so whatever goes into one end comes out of the other. lab0 is the client's end, lab1 is the server's.

Command	Where it runs
`sudo ip -n lab-client …`	`ip` in the `lab-client` namespace
`sudo ip netns exec lab-client …`	any program there, such as `ping`

Without sudo, both forms print Operation not permitted. The network from the first exercise is built by commands like these — for reference, you don't need to type them:

bash

sudo ip netns add lab-client
sudo ip netns add lab-server
sudo ip -n lab-server link add lab1 type veth \
  peer lab0 netns lab-client               # the veth pair
sudo ip -n lab-server address add 192.0.2.1/24 dev lab1
sudo ip -n lab-client address add 192.0.3.10/24 dev lab0
sudo ip -n lab-server link set lab1 up
sudo ip -n lab-client link set lab0 up

Check yourself 1 question

The network from the first exercise is built. You type ip -brief -4 address, without sudo and without -n. What will the output show?

Reading your own machine's interfaces needs no root. That error comes from ip -n lab-client without sudo: entering another namespace takes root rights.
The two ends of the pair are placed in the lab-client and lab-server namespaces. Only lo remains on the machine itself.
lab0 lives in the lab-client namespace, and a command without -n reads the interfaces of the machine itself.

Without -n, ip sees the machine's own interfaces, which is just lo. lab0 and lab1 live in the namespaces and can only be seen with sudo ip -n ….

Key points

A network namespace has its own interfaces, addresses and routes inside one kernel.
A veth pair joins two namespaces like a cable: lab0 on the client, lab1 on the server.
sudo ip -n NAME runs ip in a namespace, and sudo ip netns exec NAME runs any program there.

Interfaces, addresses and subnets

Signing in is needed to start the machine