Route from netns through a veth link

Question

I have created a network namespace (with ip netns add) and a pair of veth links, virt-a and virt-b. The physical link in the root namespace is named eth0. virt-a is in the root namespace and virt-b is in the newly created one.

IP addresses:

eth0:   192.168.1.100/24
virt-a: 192.168.1.101/24
virt-b: 192.168.1.102/24

Routing table in the root namespace:

default via 192.168.1.1 dev eth0 
192.168.1.102 dev virt-a proto kernel scope link src 192.168.1.101
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100

Routing table in the new namespace:

default dev virt-b scope link src 192.168.1.102

I can ping 192.168.1.102 from the root namespace and can ping 192.168.1.100 and 192.168.1.101 from the new namespace. However, I'm not able to ping other physical machines on the lan (eg 192.168.1.1).

I log incoming packets to the root namespace (with iptables -t raw -A PREROUTING -i virt-a -j LOG --log-prefix "[raw-PRE] " --log-level 7) and nothing makes it into the root namespace.

What am I misunderstanding about veth or namespaces?

EDIT:

I think I have misunderstood how veth works. Creating a bridge in the root namespace and making it the master of both eth0 and virt-a makes so I can can ping external devices from the new namespace.

Why is this? If I have two physical NICs and receive incoming traffic from one it can be forwarded to the other without a bridge. Shouldn't veth work the same way?

Any tips on where I can read more about the different link types in iproute? I'm having a hard time finding documentation.

Answer 1

The misunderstanding is about routing, not network namespaces: you're supposed to route IPv4 between different IPv4 networks.

Here you're trying to route IPs belonging to the same network: from 192.168.1.0/24 to 192.168.1.0/24: this doesn't get routed at all, unless special settings are made (like proxy arp and similar), which doesn't make much sense for your test case.

Use a different IP LAN, eg 192.168.2.0/24 for the veth-* network. Also the route in the network namespace has to use veth-a's IP as default gateway, not "just" the device. You might also need to add a NAT rule with iptables for outside systems around not aware of this other private network to interact properly, as well as enable ip forwarding.