My attempt is modeled on the this tutorial.
I am able to ping from the namespace to the network if the physical interface is not assigned to the bridge.
# Create namespace ip netns add namespace1 # Create veth pair. ip link add veth1 type veth peer name br-veth1 # Associate the non `br-` side with the namespace. ip link set veth1 netns namespace1 # Give namespace-side veth ip addresses. ip netns exec namespace1 ip addr add 192.168.1.11/24 dev veth1 # Create a bridge device naming it `br1` and set it up. ip link add name br1 type bridge # Turn up the bridge. ip link set br1 up # Set the bridge veth from the default namespace up. ip link set br-veth1 up # Set the veth from the namespace up too. ip netns exec namespace1 ip link set veth1 up # Add the br-veth1 interface to the bridge by setting the bridge device as their master. ip link set br-veth1 master br1 # Add the physical interface to the bridge ip link set enp3s0 master br1 # Set the address of the `br1` interface (bridge device) to 192.168.1.10/24 and also set the broadcast address to 192.168.1.255 (the `+` symbol sets the host bits to 255). ip addr add 192.168.1.10/24 brd + dev br1 # add the default gateway in all the network namespace. ip netns exec namespace1 ip route add default via 192.168.1.10 # Set us up to have responses from the network. # -t specifies the table to which the commands should be directed to. By default, it's `filter`. # -A specifies that we're appending a rule to the chain that we tell the name after it. # -s specifies a source address (with a mask in this case). # -j specifies the target to jump to (what action to take). iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE sysctl -w net.ipv4.ip_forward=1