Linux virtual networking: namespaces, veth, macvlan
You build a full network on one machine with namespaces, veth pairs, bridges, macvlan and ipvlan, and see from the inside how container and VM networking works.
Level 301 · 16 lessons · 15 practice labs
Lessons
Namespaces
- Network namespaces with ip netns
- Connecting namespaces with veth pairs
- Putting namespaces on one network with a bridge
- Getting out of namespaces: routing and NAT
- Short task: build a small network of three namespaces
Virtual interface types
- macvlan modes
- ipvlan L2 and L3
- TUN and TAP interfaces
- Dummy interfaces and service addresses
- Short task: pick the right virtual interface type for three needs
Container and VM networking
- Container networking from inside: bridge, veth and NAT
- Virtual machine networking: TAP and bridge
- Debugging inside another namespace with nsenter
- ethtool, offloads and virtual interfaces
- Short task: find out why a container cannot reach the outside
Wrap-up
- Capstone: build and script a multi-subnet test network on one machine
Practice labs
- Two namespaces, one cable: Connect two network namespaces with a veth pair, assign addresses and show connectivity between them with ping.
- One end of the cable is down: In a ready-made three-namespace network, find the down veth end, missing address and interface in the wrong namespace breaking connectivity, fix them and show full reachability.
- Parallel tests break each other’s networks: Rewrite Brightfield Labs’s test script so two copies running at once never clash on namespaces, interfaces or addresses and clean up even on failure, and show it by running two copies together.
- Put four namespaces on one network: Attach four namespaces to a Linux bridge and show they all reach each other with a ping matrix.
- The namespace cannot get out: Check one by one why a namespace cannot reach the outside (default route, ip_forward, NAT), fill the gaps and show access to an outside address.
- Out works, in does not: Use nsenter and counters to find why a web service in a namespace cannot be reached via a host port (DNAT, the output chain for local traffic, the service’s bind address), fix it and show access both from outside and from the host.
- A dummy interface for a service address: Put a service address on a dummy interface, bind the service to it and show access from another namespace.
- The macvlan container cannot see its host: Show why a namespace attached to the LAN with macvlan cannot reach its own host, and solve it with an extra macvlan interface on the host.
- Fifty test clients on a one-MAC network: On a network allowing one MAC per port, write a script creating fifty namespaces with ipvlan in L3 mode, add the host routes needed and show with an automated test that all of them reach an outside target.
- A TAP port for a virtual machine: Create a TAP interface, attach it to the bridge and show the VM-side MAC address learned in the bridge FDB.
- Bad checksums in tcpdump: Prove with ethtool and a capture at the far end whether the bad checksums seen on a virtual interface are a real fault or an offload effect.
- Small packets pass, big ones drop: Find along the path the MTU difference stalling large transfers in Saltmarsh Fisheries’s virtual network, make it consistent and prove it with large-packet pings and a file transfer.
- Which port is the container listening on?: Enter a container’s network namespace with nsenter, list listening ports and connections, and show the service bound to the wrong address.
- Which container owns this veth?: Match the one of many host veth interfaces carrying suspicious traffic to its namespace and process using interface indexes and process data.
- Names do not resolve in the namespace: Find why names do not resolve in a namespace while pinging addresses works (resolv.conf, per-namespace configuration, filtering), fix it and show it lasts by recreating the namespace.
About this course
You build a full network on one machine with namespaces, veth pairs, bridges, macvlan and ipvlan, and see from the inside how container and VM networking works.
What you will learn
- Namespaces
- Virtual interface types
- Container and VM networking
- Wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.