A Follow Up on Linux Network Namespaces

Some time ago, I introduced you to the idea of Linux network namespaces, and provided an overview of some of the commands needed to interact with network namespaces. In this post, I’ll follow up on that post with some additional information on using network namespaces with other types of network interfaces.

In the previous network namespaces article, I mentioned (incorrectly, it turns out) that you had to use virtual Ethernet (veth) interfaces in order to connect a namespace to the physical network:

It turns out you can only assign virtual Ethernet (veth) interfaces to a network namespace.

I say “incorrectly” because you are able to assign more than just virtual Ethernet interfaces to a Linux network namespace. I’m not sure why I arrived at that conclusion, because subsequent testing—using Ubuntu 12.04 LTS as with the original testing—showed no problem assigning physical interfaces to a particular network namespace. The VMs I used for the subsequent testing are using a different kernel (the 3.11 kernel instead of whatever I used in the previous testing), so it’s entirely possible that’s the difference. If I get the opportunity, I’ll try with earlier kernel builds to see if that makes any difference.

In any case, assigning other types of network interfaces to a network namespace is just like assigning veth interfaces. First, you create the network namespace:

ip netns add <new namespace name>

Then, you’d assign the interface to the namespace:

ip link set <device name> netns <namespace name>

For example, if you wanted to assign eth1 to the “blue” namespace, you’d run this:

ip link set eth1 netns blue

Please note that I haven’t found a way to unassign an interface from a network namespace other than deleting the namespace entirely.

If you want to assign a VLAN interface to a namespace, the process is slightly different. You’ll have to create the namespace first, as with physical and veth interfaces, but you’ll also have to create the VLAN interface in the “default” namespace first, then move it over to the desired namespace.

For example, first you’d create the namespace “red”:

ip netns add red

Then you’d create the VLAN interface for VLAN 100 on physical interface eth1:

ip link add link eth1 name eth1.100 type vlan id 100

The generic form of this command is this:

ip link add link <physical device> name <VLAN device name> type vlan id <VLAN ID>

Note that you can’t use ip netns exec to run the command to create the VLAN interface in the network namespace directly; it won’t work because the parent interface upon which the VLAN interface is based doesn’t exist in the namespace. So you’ll create the VLAN interface in the default namespace first, then move it over.

Once the VLAN interface is created, then move it to the target namespace:

ip link set eth1.100 netns red

One (sort of) interesting thing I noted in my testing was that link status and IP addresses don’t move between namespaces. Therefore, don’t bother assigning an IP address or setting the link state of an interface before you move it to the final namespace, because you’ll just have to do it again.

To make the interface functional inside the target namespace, you’ll use ip netns exec to target the specific configuration commands against the desired namespace. For example, if the VLAN interface eth1.100 exists in the namespace “blue”, you’d run these commands:

ip netns exec blue ip addr add 10.1.1.1/24 dev eth1.100

That adds the IP address to the interface in the namespace; then you’d use this command to set the link status to up:

ip netns exec blue ip link set eth1.100 up

Then you can test network connectivity with our good friend ping like this:

ip netns exec blue ping -c 4 10.1.1.2

(Obviously, you’d want to substitute an appropriate IP address there for your specific configuration and environment.)

I hope this additional information on working with Linux network namespaces is useful. As always, I invite and encourage any questions, thoughts, or corrections in the comments below. All courteous comments are welcome!

Tags: , ,

  1. Giuliano’s avatar

    Hi! I’m working on an application to visualize the virtual network infrastructure of a host. It’s also able to show the network namespaces for each virtual interface. You can find it here:
    https://sites.google.com/site/showmynetworkstate/

  2. smm’s avatar

    I’m sorry, I am not “in” to everything that you all are…I’m old, and even w/some college, I couldn’t begin to have an “intelligent” conversation regarding anything with you all…I’m a “simple minded old granny”. I just hoped to “squeeze” a “thank-you” in to somewhere that “Scott Lowe” might find it, for some advice he gave me a few nights ago, regarding how to go about increasing my “virtual memory”, because I kept getting error messages about my virtual memory was low every time I attempted to watch a movie. Thank you Scott…I finally figured out how to get to the settings, & have been “experimenting” a little. I guess at this end of the line XP, it can’t hurt. You sure did help me though because although I’ve taught myself a whole lot, I just couldn’t figure out how to access those settings. I bet your own granny loves you, if you have time for her now & then !

  3. slowe’s avatar

    Smm, I think you have the wrong Scott Lowe, because I haven’t written anything that I can recall on modifying virtual memory settings under Windows XP. But I’m glad you able to make it work. Good luck to you!

  4. James Denton’s avatar

    Hi Scott!

    It’s been a pleasure reading your blogs over the last few months. Now it’s my turn to share with you!

    To remove an interface from a namespace you must send it back to the ‘root’ namespace:

    ip netns exec ip link set netns 1

    That should move the interface out of the namespace and back into the host interface list.

  5. Chris R. Jones’s avatar

    Mostly FYI – your older information that you couldn’t move physical interfaces into a namespace was true at one point. The original design had issues with sysfs that made moving physical interfaces impossible. That was all fixed in Linux 2.6.35 with sysfs tagged directories.

    So, it doesn’t surprise me that there’s some conflicting info out on the web on this.

  6. washam’s avatar

    Do you have any experience with moving a bond interface into a different net namespace with its slaves?

  7. slowe’s avatar

    Washam, I haven’t tried that. I suspect you’d need to move the slave interfaces into the namespace and create the bond afterward, but that’s strictly a guess.

  8. Dmitry’s avatar

    Hi,
    In our architecture we would like to have one thread handling all virtual routers (see multiple Network namespace). But once you call setns w/ some namespace you cannot revert to default namespace. Is there any sophisticated way to revert to default namespace , as all our parent interfaces are there?

  9. Mike Schmidt’s avatar

    Hi,

    Thanks for both your blog entries. They have certainly helped me get started with network namespaces. While I am new to namespaces, I am quite familiar with linux networking, iptables, routing, tc, etc, having worked on these for over 10 years.

    In your first blog, you mentioned that one only needs to brdige the host’s veth endpoint with a physical deivice to get access to the internet. I’ ve tried this, and I cannot get to the machine at the other end of the bridged device, neither for dhcp or pings. ip_forwarding is on.

    basically my system looks like this:

    host1: vmware vm running fedora20 (3.14.4)
    host2: vmware vm running centos5.10 connected directly to host1 via vmware switch.

    host2 [eth1] host1:br0([eth1] veth0) and veth0-(ns1[veth1])

    I can ping host2 from host1 via br0, get an address via dhcp, etc
    I can ping br0 (and other addresses on host1) from ns1, etc,
    However, I cannot reach host2 from ns1, neither for dhcp, nor for ping if I give it a static ip.

    I have set host1:eth1 to promiscuos mode, to no avail.
    Oh, both host 1 and gost two are vmware vms with the e1000 driver with a direct connection through a vswitch between the two.

    Can you confirm that you tried a similar configuration and it worked? If so, what was your configuration? I have tried a number of dfferent configs, but have not been able to get any configuration where ns1 talks to host2.

  10. Mike Schmidt’s avatar

    @dmitry

    You can revert to the default namespace by simply setting your device to the namepsace for pid 1 (aasuming your namespace is ns1 and the veth devices in it is veth1):


    ip netns exec ns1 ip link set veth1 netns 1

  11. Mike Schmidt’s avatar

    @dmitry

    Sorry, my last comment was incomplete, in that I’m making assumptions. The default namespace is the one associated with init or systemd, in either case they are pid 1.

  12. Tao Zhou’s avatar

    Hi, Scott,

    If you move a physical interface to a namespace, how to make it communicate with the external network?
    Is it possible to create peer for a physical interface?

    I noticed that if I delete a namespace, it veth peer in default namespace will be deleted also.
    BTW,
    Do you know what command to use to lookup the peer device of a virtual ethernet interface?

    Thanks

    Tao

  13. slowe’s avatar

    Tao, you can move a physical interface to a namespace. If you move a physical interface to a namespace, you don’t need to do anything to get it to communicate with the outside world; it is its own connection to the outside world. You only need to supply an IP address and set the interface to up, and you should be good to do.

    Regarding looking up a veth pair, I believe the output of “ip link list” will show the veth peer, if I’m not mistaken.

  14. cpuvirtual’s avatar

    Very nice!
    Useful information shared in a simple and direct way!
    Thank you so much!

  15. Hannes’s avatar

    Does anyone tried to move a wireless interface to a namespace? When using iw command:

    iw phy phy2 set netns blue

    phy2 : wirless device
    blue: existing namespace

    …it doens’t work, because iw expects a PID.

    do I miss something, or is it only possible to move wireless interface to PID namespaces? (namespace created with unshare -n )

  16. Rob van der Hoeven’s avatar

    Hi,

    I tried to move a physical wlan interface to a namespace but it did not work. The ip command returned: RTNETLINK answers: Invalid argument

    It turns out that moving to a new network namespace is not supported by all drivers. You can find out if the driver supports namespaces by running the command:

    ethtool -k
    where: is for example wlan0 or eth0

    Namespaces are not supported if the output contains: netns-local: on [fixed]

    More info in this lecture by Rami Rosen:

    http://www.haifux.org/lectures/299/netLec7.pdf

  17. Mucius’s avatar

    Hi Scott,
    Thanks for the nice post.

    Do you know if there is a way to find out, which namespace some network adapter belongs to, if we know the adapter’s name?

    I’ve got some situation in OpenStack: there are tens of namespaces, all using the same OVS. By running ovs-vsctl show I can list existing TAP devices, but I don’t know how to find a namespace specific TAP adapter belongs to, without running “ip netns … exec ip link” for each namespace.

    Thanks!
    Mucius.

Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>