I was able to set up a network namespace and start a server that listens on inside the namespace:

# ip netns add vpn
# ip netns exec vpn ip link set dev lo up
# ip netns exec vpn nc -l -s -p 80 &

# ip netns exec vpn netstat -tlpn

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0  *               LISTEN      5598/nc

After that, I can connect to the server inside the namespace:

# ip netns exec vpn nc 80 -zv
localhost [] 80 (http) open

But I can't connect to the server outside the namespace:

# nc 80
(UNKNOWN) [] 80 (http) : Connection refused

How to configure iptables or namespace to forward traffic from the global namespace to the vpn namespace?


1 Answer 1


First: I don't think you can achieve this by using and/or a loopback interface (like lo). You have to use some other IPs and interfaces, because there are specific things hardwired for and for loopback.

Then there is certainly more than one method, but here's an example:

# ip netns add vpn
# ip link add name vethhost0 type veth peer name vethvpn0
# ip link set vethvpn0 netns vpn
# ip addr add dev vethhost0
# ip netns exec vpn ip addr add dev vethvpn0
# ip link set vethhost0 up
# ip netns exec vpn ip link set vethvpn0 up
# ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=0.134 ms
64 bytes from icmp_seq=2 ttl=64 time=0.100 ms

The first command creates out of thin air a pair of virtual ethernet interfaces connected by a virtual ethernet cable. The second command moves one of these interfaces into the netns vpn. Consider it the equivalent of things like socketpair(2) or pipe(2): a process creates a pair, then forks, and each process keeps only one end of the pair and they can communicate.

Usually (LXC, virt-manager,...) there's also a bridge involved to put everything in the same LAN when you have many netns.

Once this is in place, for the host it's like any router. Enable ip forwarding (be more restrictive if you can: you need it at least for vethhost0 and the main interface):

# echo 1 > /proc/sys/net/ipv4/conf/all/forwarding

Add some DNAT rule, like:

# iptables -t nat -A PREROUTING ! -s -p tcp -m tcp --dport 80 -j DNAT --to-destination

Now you can either add a default route inside vpn with:

# ip netns exec vpn ip route add default via

Or else, instead, add a SNAT rule to have everything be seen as coming from inside vpn.

# iptables -t nat -A POSTROUTING -d -j SNAT --to-source

With this in place you can test from any other host, but not from the host itself. To do this, also add a DNAT rule similar to the previous DNAT, but in OUTPUT and changed (else any outgoing http connexion would be changed too) to your own IP. Let's say your IP is

# iptables -t nat -A OUTPUT -d -p tcp -m tcp --dport 80 -j DNAT --to-destination

Now it will even work if you connect from the host to itself if you don't use a loopback ip, but any other IP belonging to the host with a nat rule as above. Let's say your IP is

# ip netns exec vpn nc -l -s -p 80 &
[1] 10639
# nc -vz 80
nc: myhost ( 80 [http] open
[1]+  Done                    ip netns exec vpn nc -l -s -p 80

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.