The veth pair and network namespaces
A veth pair is two virtual interfaces joined like a cable; it connects network namespaces inside one machine.
Cheat sheet
9 commands Printable version-
sudo ip netns add lab-clienta new namespace -
ip netns listwhich namespaces exist -
sudo ip link add lab1 type veth peer lab0a veth pair: lab1 <-> lab0 -
sudo ip link set lab0 netns lab-clientone end into the namespace -
sudo ip -n lab-client address add 192.0.3.10/24 dev lab0 -
sudo ip -n lab-client link set lab0 upip inside the namespace -
sudo ip netns exec lab-client ping -c 2 192.0.2.1any program there -
sudo ip -n lab-client -br linkthe namespace's interfaces -
sudo ip netns delete lab-clientdelete with its end
Overview
A network namespace is a separate set of interfaces, addresses, routes and firewall rules inside one kernel. A program started in a namespace sees only its network. Containers are built on this (see cgroups-namespaces), and so is the trainer's training network.
A veth pair is two virtual interfaces joined to each other: a packet sent into one end comes out of the other. The ends are put into different namespaces — and you get a cable between two "machines" inside one.
@if2 in the name means lab0 has a paired end whose number in the other namespace is
2. There are two ways to work in a namespace: ip -n name … runs ip in it, and ip
netns exec name command runs any program in it. Without sudo both print Operation
not permitted.
Recipes
3Find the other end of a pair
Remove the training network
A veth pair doesn't live alone: delete one end or its namespace, and the other end is gone too.
Troubleshooting
5Cannot find device "lab0"
The command runs in the wrong namespace. lab0 lives in lab-client and doesn't exist
in the machine's own network: use sudo ip -n lab-client ….
Cannot open network namespace: No such file or directory
There's no namespace with that name. List them with ip netns list.
RTNETLINK answers: File exists
An interface or address with that name already exists. Check ip -n name -br link and
ip -n name -br address; remove the extra one (ip link delete, ip address del).
The interface is UP, but ping fails
Operation not permitted
Only root can change namespaces or look inside them. Add sudo.
Terms
2- network namespace
- An isolated Linux networking environment with its own interfaces, routes and various network settings. Also appears in: nmap: which ports are visible from outside, Firewall, cgroups and namespaces, ip and 1 more
- veth pair
- Two virtual interfaces joined like a cable: what goes into one end comes out of the other. They connect network namespaces. Also appears in: ping, cgroups and namespaces, Docker, ip
See also
- ip — addresses, subnets and routes, inside a namespace too.
- ping — check the link between the two ends.
- cgroups-namespaces — namespaces and cgroups in general, containers.
- network-diagnostics — the connectivity ladder.
- firewall — each namespace has its own nftables rules.
Found an inaccuracy? Report an error in the article