Creating VLANs between network namespaces

Question

I want to implement the topology shown in the figure below using network namespaces (ns1 to ns4).

                      

I can implement the above topology without splitting the network into two different VLANs using the following commands (based on this article, titled: Introducing Linux Network Namespaces):

sudo ip netns add ns1
sudo ip netns add ns2
sudo ip netns add ns3
sudo ip netns add ns4

sudo ip link add veth1 type veth peer name veth11
sudo ip link add veth2 type veth peer name veth12
sudo ip link add veth3 type veth peer name veth13
sudo ip link add veth4 type veth peer name veth14

sudo ip link set veth11 netns ns1
sudo ip link set veth12 netns ns2
sudo ip link set veth13 netns ns3
sudo ip link set veth14 netns ns4

sudo ip netns exec ns1  ifconfig lo up
sudo ip netns exec ns2  ifconfig lo up
sudo ip netns exec ns3  ifconfig lo up
sudo ip netns exec ns4  ifconfig lo up

sudo ifconfig veth1 10.1.11.1/24 up
sudo ifconfig veth2 10.1.12.1/24 up
sudo ifconfig veth3 10.1.13.1/24 up
sudo ifconfig veth4 10.1.14.1/24 up

sudo ip netns exec ns1 ifconfig veth11 10.1.11.2/24 up
sudo ip netns exec ns2 ifconfig veth12 10.1.12.2/24 up
sudo ip netns exec ns3 ifconfig veth13 10.1.13.2/24 up
sudo ip netns exec ns4 ifconfig veth14 10.1.14.2/24 up

sudo ip netns exec ns1 route add default gw 10.1.11.1 veth11
sudo ip netns exec ns2 route add default gw 10.1.12.1 veth12
sudo ip netns exec ns3 route add default gw 10.1.13.1 veth13
sudo ip netns exec ns4 route add default gw 10.1.14.1 veth14

Based on the above setup everyone can ping everyone else. Now I want to isolate ns1 and ns3 in one VLAN, and ns2 and ns4 in another. To implement the VLAN's I'm trying to use something like the following:

sudo vconfig add veth1 11
sudo vconfig add veth3 11
sudo vconfig add veth11 12
sudo vconfig add veth13 12

However still everyone can ping everyone else meaning that the network isn't divided into two different LANS. How can I achieve what I'm trying? Is there a different method for VLAN tagging for virtual interfaces?

Answer 1

Several things are mixed up:

1. In your graphic you let the “default namespace” look like a switch, but you configured it to a router.
2. With a router in the middle, vlan1 and the other vlan1 are different. They don’t share the same LAN, so they can’t be in the same VLAN.
3. Your vconfig calls will not find veth11 or veth13, because they are not in the default namespace. – You didn’t get any errors!?
4. veth1 and veth11 are one “pipe”. Why do you assign them different VLAN IDs?
5. Why don’t you put one end of the pipe in ns1 (you do that), and the other end in ns3 (instead of the default namespace). – You can then route or bridge between them, without even mixing it with ns2 and ns4.
6. Or in other words: don’t mix everything together in the default namespace, just to split them again later...
7. You can also do it in the way seen in the diagram, but don’t work with routing or IP addresses (and then VLANS on top!?!): Put two bridges in the default namespace, connect one side of each “pipe” in one of the bridges. – One bridge (this time configured with VLANS) would do it, too. I haven’t checked if the Linux bridge code is VLAN aware,though. It probably is.
8. Your veth-names are confusing. Why not “eth1a” together with “eth1b” or something similar in a symmetric fashion?
9. ip obsoletes ifconfig and vconfig