How to correctly setup DNS for a macvlan in a namespace (ping IP works, ping URL does not)?

Question

I have set up macvlan in a namespace on a server. I can ping accross default namespace and macvlan namespace, i can even ping the macvlan namespace from any other client in the LAN.

But DNS is not working. What do I have to configure additionally?

pi@testpi:~ $ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether b8:27:eb:98:70:4b brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.222/24 brd 192.168.100.255 scope global dynamic noprefixroute eth0
       valid_lft 84768sec preferred_lft 73968sec
    inet6 fe80::247e:fd3c:36d7:68f5/64 scope link 
       valid_lft forever preferred_lft forever
4: hostmacvlanben0@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether b8:27:eb:98:70:4c brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.222/24 scope global noprefixroute hostmacvlanben0
       valid_lft forever preferred_lft forever
    inet 192.168.100.174/24 brd 192.168.100.255 scope global secondary dynamic noprefixroute hostmacvlanben0
       valid_lft 84792sec preferred_lft 73992sec
    inet6 fe80::8d5f:20a4:abba:2d1c/64 scope link 
       valid_lft forever preferred_lft forever
    inet6 fe80::ba27:ebff:fe98:704c/64 scope link 
       valid_lft forever preferred_lft forever


pi@testpi:~ $ ip r
default via 192.168.100.1 dev eth0 proto dhcp src 192.168.100.222 metric 202 
default via 192.168.100.1 dev hostmacvlanben0 proto dhcp src 192.168.100.174 metric 204 
192.168.100.0/24 dev eth0 proto dhcp scope link src 192.168.100.222 metric 202 
192.168.100.0/24 dev hostmacvlanben0 proto dhcp scope link src 192.168.100.174 metric 204 
192.168.100.224 dev hostmacvlanben0 scope link 

Output for the namespace nsben1:

pi@testpi:~ $ sudo ip netns exec nsben1 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
3: macvlanclient1@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether b8:27:eb:98:70:4d brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 192.168.100.224/24 scope global macvlanclient1
       valid_lft forever preferred_lft forever
    inet6 fe80::ba27:ebff:fe98:704d/64 scope link 
       valid_lft forever preferred_lft forever


pi@testpi:~ $ sudo ip netns exec nsben1 ip r
default via 192.168.100.1 dev macvlanclient1 
192.168.100.0/24 dev macvlanclient1 proto kernel scope link src 192.168.100.224 

Ping IP works, ping URL does not work:

pi@testpi:~ $ sudo ip netns exec nsben1 ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=111 time=23.0 ms
^[[A64 bytes from 8.8.8.8: icmp_seq=2 ttl=111 time=24.3 ms
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 2ms
rtt min/avg/max/mdev = 23.003/23.667/24.332/0.682 ms


pi@testpi:~ $ sudo ip netns exec nsben1 ping google.com
ping: google.com: Temporary failure in name resolution

traceroute does not give any hints:

pi@testpi:~ $ sudo ip netns exec nsben1 traceroute google.com
google.com: Temporary failure in name resolution
Cannot handle "host" cmdline arg `google.com' on position 1 (argc 1)

My /etc/resolv.conf is:

pi@testpi:~ $ cat /etc/resolv.conf
# Generated by resolvconf
nameserver 192.168.100.1

192.168.100.1 is the edge-router in my private LAN. I then have a cable modem from the ISP, also.

---

Checking with tcpdump on the IP of the macvlan namespace nsben1 and then pinging from inside the namespace to 8.8.8.8 results in getting some answer back:

pi@testpi:~ $ sudo tcpdump --interface eth0 host 192.168.100.224
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
15:43:45.417310 IP 192.168.100.224 > dns.google: ICMP echo request, id 20611, seq 1, length 64
15:43:45.440190 IP dns.google > 192.168.100.224: ICMP echo reply, id 20611, seq 1, length 64
15:43:46.418707 IP 192.168.100.224 > dns.google: ICMP echo request, id 20611, seq 2, length 64
15:43:46.440392 IP dns.google > 192.168.100.224: ICMP echo reply, id 20611, seq 2, length 64

and pinging to www.google.com is not getting any answer. It is pinging to 8.8.1.1 which I don't understand (note that pinging 8.8.1.1 directly is also not getting any answer):

15:44:13.988596 IP 192.168.100.224.45822 > 8.8.1.1.domain: 22489+ A? google.com. (28)
15:44:13.989314 IP 192.168.100.224.45822 > 8.8.1.1.domain: 25561+ AAAA? google.com. (28)
15:44:18.994541 IP 192.168.100.224.45822 > 8.8.1.1.domain: 22489+ A? google.com. (28)
15:44:18.994660 IP 192.168.100.224.45822 > 8.8.1.1.domain: 25561+ AAAA? google.com. (28)

---

I used edited /etc/dhcpcd.conf to change the nameserver from 192.168.100.1 to 8.8.8.8 and restarted the service. Now resolv.conf shows nameserver 8.8.8.8 but still the behaviour is the same.

Answer 1

No special setup should be necessary:

Normally, the nameserver provided in /etc/resolv.conf in the default namespace should be used in the additional namespace (nsben1), also.

---

In my case this was not working.

At first I had my LAN router as nameserver, but changed this to 8.8.8.8 in an attempt to test if something was wrong from the DNS of my routers side.

Since this did not change the behaviour I investigated more and found that sudo ip netns exec nsben1 cat /etc/resolv.conf showed nameserver 8.8.1.1.

This was wrong. Even ping 8.8.1.1 does not give any response.

I did not check this from the namespace nsben1 earlier because I assumed that it simply would be the same. Changes to /etc/resolv.conf can be made in case of a RaspberryPi OS by editing /etc/dhcpcd.conf using the line static domain_name_servers=.

After a reboot the namespace now also shows 8.8.8.8 and DNS works fine.