0

I have an Ubuntu 18.04 server with one public network interface (eth0). I'm trying to create additional "virtual" network interfaces that will also be able to access the internet with NAT rules set up.

I've created a virtual interface using the following commands:

ip link add type veth

ifconfig veth0 192.168.1.1

Below is the output of my ifconfig:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet 10.0.0.1  netmask 255.255.255.0  broadcast 10.0.0.255
    ether f2:3c:92:1f:2a:62  txqueuelen 1000  (Ethernet)
    RX packets 85664  bytes 111561237 (111.5 MB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 15392  bytes 2229468 (2.2 MB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
    inet 127.0.0.1  netmask 255.0.0.0
    loop  txqueuelen 1000  (Local Loopback)
    RX packets 1385  bytes 213213 (213.2 KB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 1385  bytes 213213 (213.2 KB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

veth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet 192.168.1.1  netmask 255.255.255.0  broadcast 192.168.1.255
    ether a6:e7:de:40:9a:28  txqueuelen 1000  (Ethernet)
    RX packets 27  bytes 2082 (2.0 KB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 1132  bytes 48520 (48.5 KB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

I've set "/proc/sys/net/ipv4/ip_forward" to 1:

$ cat /proc/sys/net/ipv4/ip_forward

1

I also tried numerous iptables MASQUERADE, FORWARD, and NAT rules but can't get internet access working from veth0.

When I ping 192.168.1.1 from the veth0 interface it all works:

$ ping -I veth0 192.168.1.1

PING 192.168.1.1 (192.168.1.1) from 192.168.1.1 veth0: 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.029 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.046 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.085 ms
64 bytes from 192.168.1.1: icmp_seq=4 ttl=64 time=0.062 ms
64 bytes from 192.168.1.1: icmp_seq=5 ttl=64 time=0.061 ms
--- 192.168.1.1 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4097ms
rtt min/avg/max/mdev = 0.029/0.056/0.085/0.020 ms

However if I try pinging the eth0 interface IP address from veth0 I get no response:

$ ping -I veth0 10.0.0.1

PING 10.0.0.1 (10.0.0.1) from 192.168.1.1 veth0: 56(84) bytes of data.
--- 10.0.0.1 ping statistics ---
39 packets transmitted, 0 received, 100% packet loss, time 38900ms

Below is the output of my route command:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gw-li832.linode 0.0.0.0         UG    0      0        0 eth0
xx.xx.xx.xx     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 veth0

I can't seem to figure out what I'm doing wrong and any help would be appreciated.

  • If you want to use a computer as host for virtual machines there you also wants the physical machine and the virtual ones to reach each other but you only have one iface ... it is necessary to use a bridge (you create them with brctl or NetworkManager:s nmcli.) The physical computer's os wont se the ARP request for example (if you don't connect the virtual machines and the host via an virtual bridge.) – Stefan Skoglund Mar 4 at 22:53
  • @StefanSkoglund you should add this to your answer. You explained the problem well and provided a possible solution. – Maze Mar 5 at 0:20
0

If you want to use a computer as host for virtual machines there you also wants the physical machine and the virtual ones to be reachable in both directions but if you only have one iface ...

it is necessary to use a bridge (you create them with brctl or NetworkManager:s nmcli.) Though macvtap for example changes this.

The physical computer's os wont see even the ARP requests from the virtual machines (if you don't connect the virtual machines and the host via an virtual bridge) due to the design of the networking stack in Linux.

In the last part of this: https://wiki.archlinux.org/index.php/Network_bridge, is the recipe i used to be able to allow the physical host and the virtual machines in the machine to reach each other.

One other solution could be hair-pin rules in your router/firewall.

In http://man7.org/linux/man-pages/man4/veth.4.html they discusses veth devices, so in their example they treat the veth device as a pipe with two names. You didn't add a peer name in your example.

| improve this answer | |
  • Thanks, I'll give this a try and let you know how it goes! – RogueKnight Mar 4 at 23:31
  • The veth pairs actually did the trick. I actually found a great guide on josephmuia.ca/2018-05-16-net-namespaces-veth-nat. Basically I had to create two veth interface pairs and attach one to a new network namespace. I'm going to accept your answer and post my full solution below. Thanks for the help! – RogueKnight Mar 5 at 7:35
1

I accepted @StefanSkoglund's answer as it pointed me in the right direction to solve this issue however I wanted to post my full solution below for anyone else who finds it useful.

The used the following guide to help me along the way:

https://josephmuia.ca/2018-05-16-net-namespaces-veth-nat/

Basically I had to create two veth interface pairs and attach one to a new network namespace. The following commands accomplished this:

First I enabled IP forwarding with the following:

echo 1 > /proc/sys/net/ipv4/ip_forward

Then I created a new network namespace (netns0) and attached a new loopback adapter to it. It will not work without this step:

ip netns add netns0
ip netns exec netns0 ip link set lo up

I then created two veth pairs. These basically function as two ends of an Ethernet line. One end stays on the main network and the other end is connected to the network namespace:

ip link add veth0a type veth peer name veth0b
ip link set veth0b netns netns0

Then I set IP addresses for each interface in the pair and enabled them:

ip addr add 192.168.0.1/24 dev veth0a
ip netns exec netns0 ip addr add 192.168.0.2/24 dev veth0b
ip link set veth0a up
ip netns exec netns0 ip link set veth0b up

The following iptable rules enabled forwarding and nating:

iptables -A FORWARD -o eth0 -i veth0a -j ACCEPT
iptables -A FORWARD -i eth0 -o veth0a -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.0.2/24 -o eth0 -j MASQUERADE

The following command set a default route for the namespace. This is essential for communicating with the main network:

ip netns exec netns0 ip route add default via 192.168.0.1

Finally I created a namespace specific resolv.conf file with my DNS servers. This is essential for domain name resolutions from the network namespace:

mkdir -p /etc/netns/netns0
echo "nameserver 1.1.1.1" > /etc/netns/netns0/resolv.conf

After these steps I am able to communicate with the Internet using the network namespace:

$ ip netns exec netns0 ping google.com

PING google.com (172.217.10.238) 56(84) bytes of data.
64 bytes from lga25s59-in-f14.1e100.net (172.217.10.238): icmp_seq=1 ttl=57 time=2.50 ms
64 bytes from lga25s59-in-f14.1e100.net (172.217.10.238): icmp_seq=2 ttl=57 time=1.44 ms
64 bytes from lga25s59-in-f14.1e100.net (172.217.10.238): icmp_seq=3 ttl=57 time=1.39 ms
--- google.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 1.392/1.779/2.505/0.514 ms

Using "ip netns exec netns0 (COMMAND)" allows you to run commands with this namespace.

| improve this answer | |
  • Thanks, i learned a bit (should educate myself about net namespaces...) – Stefan Skoglund Mar 5 at 9:57
  • Thanks for pointing me in that direction. I have to say network namespaces are really interesting and allow you do some really cool things. I just set up a namespace jail so that i can have separate network namespaces and IP addresses per user. Now when individual users SSH into the server they are locked into that namespace and all their traffic goes out through the respective interface. – RogueKnight Mar 5 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.