I have created a network namespace (with
ip netns add) and a pair of
virt-b. The physical link in the root namespace is named
virt-a is in the root namespace and
virt-b is in the newly created one.
eth0: 192.168.1.100/24 virt-a: 192.168.1.101/24 virt-b: 192.168.1.102/24
Routing table in the root namespace:
default via 192.168.1.1 dev eth0 192.168.1.102 dev virt-a proto kernel scope link src 192.168.1.101 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100
Routing table in the new namespace:
default dev virt-b scope link src 192.168.1.102
I can ping 192.168.1.102 from the root namespace and can ping 192.168.1.100 and 192.168.1.101 from the new namespace. However, I'm not able to ping other physical machines on the lan (eg 192.168.1.1).
I log incoming packets to the root namespace (with
iptables -t raw -A PREROUTING -i virt-a -j LOG --log-prefix "[raw-PRE] " --log-level 7) and nothing makes it into the root namespace.
What am I misunderstanding about veth or namespaces?
I think I have misunderstood how veth works. Creating a bridge in the root namespace and making it the master of both
virt-a makes so I can can ping external devices from the new namespace.
Why is this? If I have two physical NICs and receive incoming traffic from one it can be forwarded to the other without a bridge. Shouldn't veth work the same way?
Any tips on where I can read more about the different link types in iproute? I'm having a hard time finding documentation.