I'm trying to set up two network namespaces to communicate with eachother. I've set up two namespaces, ns0 and ns1 that each have a veth pair, where the non-namespaced side of the veth is linked to a bridge.

I set it up like this:

ip link add veth0 type veth peer name brveth0
ip link set brveth0 up

ip link add veth1 type veth peer name brveth1
ip link set brveth1 up

ip link add br10 type bridge
ip link set br10 up

ip addr add brd + dev br10

ip netns add ns0
ip netns add ns1

ip link set veth0 netns ns0
ip link set veth1 netns ns1

ip netns exec ns0    ip addr add dev veth0
ip netns exec ns0    ip link set veth0 up
ip netns exec ns0    ip link set lo up

ip netns exec ns1    ip addr add dev veth1
ip netns exec ns1    ip link set veth1 up
ip netns exec ns1    ip link set lo up

ip link set  brveth0 master br10
ip link set  brveth1 master br10

As expected, I can ping the interface in ns0 from ns1.

$ sudo ip netns exec ns1 ping -c 3
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=0.099 ms
64 bytes from icmp_seq=2 ttl=64 time=0.189 ms

But, I can't connect the two over TCP.

For example, running a server in ns0 :

$ sudo ip netns exec ns0 python3 -m http.server 8080
Serving HTTP on port 8080 ( ...

I would expect to be able to curl it from ns1, but that yields an error:

$ sudo ip netns exec ns1 curl
curl: (7) Failed to connect to port 8080: No route to host

Why is this happening?

  • 1
    Looks like it should work... You can also test with nc/netcat/socat (test in two windows in the main namespace first if you haven't used those, one for the "server" (listens), one for the "client" (connects)). BTW, if you start an xterm in each namespace, debugging is much more pleasant. Oh, and check for iptables rules, just in case.
    – dirkt
    Oct 11 '19 at 3:13
  • The only possible culprit is the bridge on the host namespace (which gets exposed to firewall rules, including to iptables ). Try the experiment again with a 3rd network namespace where the bridge will be created (bridges can't be moved) and veth links moved and attached accordingly.
    – A.B
    May 21 '20 at 2:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.