I may be using the wrong tool, but network namespaces seemed like a near ideal fit.
I have 3 programs that don't have the ability to specify an listening interface or address (that only listen on "0.0.0.0"). I want to put those services in a netns where they only see the internal addresses (i.e. 192.168.3.0/24), preventing them from listening to external traffic.
I created a netns named 'Local' and created a veth to straddle the main and Local ns's, like:
ip link add veth1 type veth peer name vpe1
I enslaved veth1 to a local bridge (br0) along with 2 other physical interfaces. "brctl show br0" now shows 3 interfaces: eth0, eth5, and veth1.
Next I set vpe1's IP to "129" on the local net. Testing showed I was able to ping it from other hosts and from a bash-shell in the Local-ns, I was only able to ping hosts on the local net.
However, the progs (one being xinetd) are meant to service calls at the server's local net address (the bridge addr of 192.168.3.1). Having a different IP in the 'local-only' namespace doesn't work for having them respond to services on the 'server'.
Trying a few other options -- I first tried giving the same hostname to the IP for 'vpe1' inside its namespace, then tried giving the same IP... nothing worked or had an effect.
Conceptually, I thought to have a sub netns duplicate the main name space and then drop the external interface from the from it -- leaving those procs only seeing the local interface and servicing requests just as they had before when they saw all the interfaces (and weren't in a namespace).
While this seems to be an ideal place for a separate namespace to give a different logical view of the server's interfaces to a group of processes, I am not seeing how to have the netns's simply provide a different "view" (to use 'bind/named-speak') to those "clients".
Is this possible with linux's net namespaces? Or what are they missing that could allow this? If this type of "sectioning" isn't provided by namespaces, is it possible to provide it without lots of iptable routing to simulate those client-progs being in the main namespace?