# Create new network namespace
ip netns add nns_pink
# Traffic between "main" and "pink" is routed via veth
# Create veth pipe between vem_pink and ves_pink
ip link add vem_pink type veth peer name ves_pink
# Move ves_pink veth to nns_pink namespace
ip link set ves_pink netns nns_pink
# Configure internal network running over veth
ip addr add 10.251.251.1/24 dev vem_pink
ip link set up dev vem_pink
# And nns_pink side
ip netns exec nns_pink ip addr add 10.251.251.2/24 dev ves_pink
ip netns exec nns_pink ip link set up dev ves_pink
# Allow "main" to talk with outside world via "pink" by masquerading
ip netns exec nns_pink iptables -t nat -A POSTROUTING -s 10.251.251.1 -j MASQUERADE
# Routing must also be enabled
ip netns exec nns_pink sysctl net.ipv4.ip_forward=1
ip netns exec nns_pink sysctl net.ipv4.conf.ves_pink.forwarding=1
# Traffic between Internet (eth0) and "pink" is bridged over macvlan
# Create new macvlan alias called mvl_pink
ip link add link eth0 dev mvl_pink type macvlan
# Use fixed mac address instead of auto generated random mac
ip link set dev mvl_pink address 00:60:2f:00:00:00
# Move mvl_pink macvlan to nns_pink namespace
ip link set mvl_pink netns nns_pink
# Setup loopback on nns_pink namespace
ip netns exec nns_pink ip addr add 127.0.0.1/8 dev lo
ip netns exec nns_pink ip link set up dev lo
# Fetch DHCP allocated Internet IP for pink
ip netns exec nns_pink dhclient -nw -v \
-pf /run/dhclient.mvl_pink.pid \
-lf /var/lib/dhcp/dhclient.mvl_pink.leases mvl_pink
-pf /run/dhclient.mvl_pink.pid \
-lf /var/lib/dhcp/dhclient.mvl_pink.leases mvl_pink
# Confirm that dhclient is binded only on nns_pink
netstat -nlp|grep ":68 "
ip netns exec nns_pink netstat -nlp|grep ":68 "
# Check our public IP using OpenDNS "myip.opendns.com" trick
dig +short myip.opendns.com @208.67.222.222
# And it should be different in nns_pink netns
ip netns exec nns_pink dig +short myip.opendns.com @208.67.222.222
# Route traffic to OpenDNS resolver via pink
ip route add 208.67.222.222 via 10.251.251.2 dev vem_pink
# Recheck our IP, it should now show IP of pink due routing + masquerading
dig +short myip.opendns.com @208.67.222.222
# Release DHCP lease and stop dhclient
ip netns exec nns_pink dhclient -r -v \
-pf /run/dhclient.mvl_pink.pid \
-lf /var/lib/dhcp/dhclient.mvl_pink.leases mvl_pink
-pf /run/dhclient.mvl_pink.pid \
-lf /var/lib/dhcp/dhclient.mvl_pink.leases mvl_pink
# Remove nns_pink network namespace
ip netns del nns_pink
No comments:
Post a Comment
Got something to say?!