I set up a virtual ethernet (veth) pair between default namespace and another namespace named RoutableNS as follow:

--------------              --------------
-   veth0    - --------------    veth1   -
-  -              -  -
--------------              --------------
  default NS                 RoutableNS

I can ping outside world in namespace RoutableNS through interface veth1 but It turns out when I SNAT (or MASQUERADE) incoming traffic to (or nothing will come to veth interface.

I tried same thing with tun devices and I saw It's not possible to MASQUERADE to tun device when It's IP is not routable to outside world (in default namespace).

So I have two questions:

  1. Is this behaviour of SNAT (MASQUERADE) documented somewhere? I mean the behaviour that new source IPs should be routable to outside world in current namespace.
  2. Is there a networking options (sysctls) letting me do this?

1 Answer 1


It's perfectly possible to masquerade or SNAT a device whose IP is not routable to the outside world. And being in a network namespace or not makes no difference.

You conveniently forgot to tell us what exactly you tried, but keep in mind that SNAT and MASQUERADE only work in the POSTROUTING table (while DNAT only works in the PREROUTING table), a fact which is well documented, and which you can't avoid to mention explicitely in the iptable commands.

That means SNAT will happen as the last step before the packet leaves the interface, and DNAT will happen as a very early steps for packets entering the interface from the outside.

So the usual setup is that a router (host or namespace) NATs IPs that come in from one side, to everything on the other side:

                |               |
masq'ed IP --<--| eth0     eth1 |--<-- original IP       |               |
                Host or Namespace

and you need a corresponding DNAT for incoming connections, so:

iptables -t nat -A POSTROUTING -o eth0 -s  -j SNAT --to
iptables -t nat -A PREROUTING  -i eth0 -d -j DNAT --to

You didn't say exactly what IPs you want to masquerade as what IPs, but if your main namespace acts as such a router, and you want to mask "RouteableNS", that is, to the outside world, then this is doable by using the outgoing IF of your main namespace.

  • You are right, after changing IP rules to select veth0 as output interface, I can SNAT to veth1 which is in other namespace. Thanks. One nice thing is I can make an SNAT in each namespace, so I have another SNAT in that interface to a private interface.
    – reith
    Jun 22, 2017 at 12:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .