ping server in namespace from remote machine

Question

If I run web server in default namespace of SERVER machine I can curl it from REMOTE machine doing that:

curl http://SERVER:80/

Now I put web server in namespace nested with providing veth peered with nested's network interface:

sudo ip link add veth type veth peer name vpeer
sudo ip link set vpeer netns nested
sudo ip addr add 192.168.3.77/24 dev veth
sudo ip link set veth up
sudo ip netns exec nested ip addr add 192.168.3.78/24 dev vpeer
sudo ip netns exec nested ip link set vpeer up
sudo ip netns exec nested ip route add default via 192.168.3.77

so I can ping it from default namespace:

curl --interface veth 192.168.3.78:80/

My question: how to ping web server in nested namespace from remote machine? Seems that curl http://SERVER:80/ becomes to lo interface. Can I point external requests to veth interface or how to configure pairing?

Answer 1

1. The remote host must have a route to the nested namespace ip address (192.168.3.78). The routing setup depends on many factors.
2. The ip forwarding should be enabled in the default namespace (sysctl variable net.ipv4.ip_forward should be 1).
3. The firewall should allow the forwarded packets between the veth and lan interfaces. At result you should have a success ping between the remote host and the nested namespace.
4. If the SERVER domain name points to one of local ip addresses, you should use the DNAT target to redirect the request into the netsted namespace:

iptables -t nat -I PREROUTING -p tcp --dport 80 --dst <orig-ip> -j DNAT --to 192.168.3.78
iptables -t nat -I OUTPUT -p tcp --dport 80 --dst <orig-ip> -j DNAT --to 192.168.3.78

5. Use the tcpdump to troubleshoot issues.