1

I have an Ubuntu 18.04 server with one public network interface (eth0). I'm trying to create additional "virtual" network interfaces that will also be able to access the internet with NAT rules set up.

I've created a virtual interface using the following commands:

ip link add type veth

ifconfig veth0 192.168.1.1

Below is the output of my ifconfig:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet 10.0.0.1  netmask 255.255.255.0  broadcast 10.0.0.255
    ether f2:3c:92:1f:2a:62  txqueuelen 1000  (Ethernet)
    RX packets 85664  bytes 111561237 (111.5 MB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 15392  bytes 2229468 (2.2 MB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
    inet 127.0.0.1  netmask 255.0.0.0
    loop  txqueuelen 1000  (Local Loopback)
    RX packets 1385  bytes 213213 (213.2 KB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 1385  bytes 213213 (213.2 KB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

veth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet 192.168.1.1  netmask 255.255.255.0  broadcast 192.168.1.255
    ether a6:e7:de:40:9a:28  txqueuelen 1000  (Ethernet)
    RX packets 27  bytes 2082 (2.0 KB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 1132  bytes 48520 (48.5 KB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

I've set "/proc/sys/net/ipv4/ip_forward" to 1:

$ cat /proc/sys/net/ipv4/ip_forward

1

I also tried numerous iptables MASQUERADE, FORWARD, and NAT rules but can't get internet access working from veth0.

When I ping 192.168.1.1 from the veth0 interface it all works:

$ ping -I veth0 192.168.1.1

PING 192.168.1.1 (192.168.1.1) from 192.168.1.1 veth0: 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.029 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.046 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.085 ms
64 bytes from 192.168.1.1: icmp_seq=4 ttl=64 time=0.062 ms
64 bytes from 192.168.1.1: icmp_seq=5 ttl=64 time=0.061 ms
--- 192.168.1.1 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4097ms
rtt min/avg/max/mdev = 0.029/0.056/0.085/0.020 ms

However if I try pinging the eth0 interface IP address from veth0 I get no response:

$ ping -I veth0 10.0.0.1

PING 10.0.0.1 (10.0.0.1) from 192.168.1.1 veth0: 56(84) bytes of data.
--- 10.0.0.1 ping statistics ---
39 packets transmitted, 0 received, 100% packet loss, time 38900ms

Below is the output of my route command:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gw-li832.linode 0.0.0.0         UG    0      0        0 eth0
xx.xx.xx.xx     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 veth0

I can't seem to figure out what I'm doing wrong and any help would be appreciated.

1 Answer 1

0

I was able to solve this using the following guide:

https://josephmuia.ca/2018-05-16-net-namespaces-veth-nat/

Basically I had to create two veth interface pairs and attach one to a new network namespace. The following commands accomplished this:

First I enabled IP forwarding with the following:

echo 1 > /proc/sys/net/ipv4/ip_forward

Then I created a new network namespace (netns0) and attached a new loopback adapter to it. It will not work without this step:

ip netns add netns0
ip netns exec netns0 ip link set lo up

I then created two veth pairs. These basically function as two ends of an Ethernet line. One end stays on the main network and the other end is connected to the network namespace:

ip link add veth0a type veth peer name veth0b
ip link set veth0b netns netns0

Then I set IP addresses for each interface in the pair and enabled them:

ip addr add 192.168.0.1/24 dev veth0a
ip netns exec netns0 ip addr add 192.168.0.2/24 dev veth0b
ip link set veth0a up
ip netns exec netns0 ip link set veth0b up

The following iptable rules enabled forwarding and nating:

iptables -A FORWARD -o eth0 -i veth0a -j ACCEPT
iptables -A FORWARD -i eth0 -o veth0a -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.0.2/24 -o eth0 -j MASQUERADE

The following command set a default route for the namespace. This is essential for communicating with the main network:

ip netns exec netns0 ip route add default via 192.168.0.1

Finally I created a namespace specific resolv.conf file with my DNS servers. This is essential for domain name resolutions from the network namespace:

mkdir -p /etc/netns/netns0
echo "nameserver 1.1.1.1" > /etc/netns/netns0/resolv.conf

After these steps I am able to communicate with the Internet using the network namespace:

$ ip netns exec netns0 ping google.com

PING google.com (172.217.10.238) 56(84) bytes of data.
64 bytes from lga25s59-in-f14.1e100.net (172.217.10.238): icmp_seq=1 ttl=57 time=2.50 ms
64 bytes from lga25s59-in-f14.1e100.net (172.217.10.238): icmp_seq=2 ttl=57 time=1.44 ms
64 bytes from lga25s59-in-f14.1e100.net (172.217.10.238): icmp_seq=3 ttl=57 time=1.39 ms
--- google.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 1.392/1.779/2.505/0.514 ms

Using "ip netns exec netns0 (COMMAND)" allows you to run commands with this namespace.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .