Is there a way I can move a secondary IP into its own namespace while keeping the primary IP on the original device?

If I have and on device eth0, but I want to be in its own netns test, the closest I've come to that involves adding a veth pair and a bridge, and moving the eth0 primary IP to the bridge:

  netns: test              netns: default
==============     ===============================
vethB: <-> vethA <-> br0: <-> eth0

Unfortunately moving the IP off of eth0 will confuse a few opaque legacy applications on the box, so I'd prefer to keep that on eth0.


The Linux macvlan device is a workable solution here.

It instantiates a layer 2 subinterface which is a bona fide logical device, unlike the eth0:1 administrative fiction to manage secondary IPs, which I may then move into a network namespace and address. Example:

#  netns: test        netns: default
# ==============     ================
# test0: <->  eth0:

# Create "test" network namespace
ip netns add test
ip netns exec test ip link set lo up

# Create subinterface and move to "test"
ip link add link eth0 name test0 type macvlan
ip link set test0 netns test

# Configure the subinterface
ip netns exec test ip addr add brd + dev test0

This preserves the "primary" IP on eth0 and thus keeps the existing system more-or-less unaware of my hidden "secondary" IP.


A given device can only be in one namespace, see https://lwn.net/Articles/580893/ :

Aside from the loopback device, each network device (physical or virtual interfaces, bridges, etc.) can only be present in a single network namespace.

So your eth0 can only be in one. Your setup, with two virtual interfaces and a bridge is a solution to this problem. I do not understand what it changes for applications if the IP is tied to br0 instead of eth0, they should not see a difference. Otherwise you will need to provide more details. Did you really get problems, and if so, which ones, or do you just expect them?

If you can uses them, have a look at VLANs: you can put each of them (off the same physical interface) in different namespaces. This is detailed here: https://blog.scottlowe.org/2014/03/21/a-follow-up-on-linux-network-namespaces/

If you can not use a bridge or VLANs, you will need to setup some IP forwarding or NAT.

  • Thanks. Can you elaborate on the L3 forwarding or NAT'ing? 802.1q VLANs are infeasible as I don't control the wire/trunking, and my veth-pair-bridge approach, again, would be too intrusive. (I'm not pleased with that constraint, but so it is.) – pilcrow Mar 6 '18 at 18:00
  • Have a look at unix.stackexchange.com/a/393468/211833 Basically the default route of vethB should be pointing to eth0 IP. – Patrick Mevzek Mar 7 '18 at 22:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.