Linux Network Namespaces and Packet Paths

A practical model for namespaces, veth pairs, bridges, routing, NAT, and where packets disappear.

Linux ยท Networking

Linux network namespaces give processes separate network stacks. Each namespace has its own interfaces, addresses, routes, neighbor table, firewall state, and sockets. Containers use this isolation, but the mechanics are ordinary Linux networking.

Namespace model

A process belongs to one network namespace. Interfaces also belong to one namespace at a time. A veth pair acts like a patch cable: a packet transmitted on one end is received on the other.

Common container shape:

container namespace       host namespace
-------------------       ----------------
eth0  <--------------->   vethXYZ
                           bridge docker0 or cni0
                           host routing and NAT
                           physical NIC

The container sees eth0. The host sees the peer and usually attaches it to a bridge or routes it directly.

Packet path

For an outbound packet from a container:

  1. process writes to a socket,
  2. namespace route lookup selects eth0,
  3. packet exits through veth peer into host namespace,
  4. bridge or host routing chooses the next hop,
  5. firewall and NAT rules may rewrite or drop it,
  6. packet exits through the host interface.

For inbound traffic, reverse the path and include destination NAT if the host maps a port into the container.

Routing and NAT

A route answers where the packet should go next. NAT rewrites addresses or ports. They are separate mechanisms.

Source NAT for outbound container traffic often rewrites container source addresses to the host address so replies can route back:

10.244.0.5:51514 -> 1.1.1.1:443
becomes
203.0.113.10:40001 -> 1.1.1.1:443

Connection tracking remembers the mapping for replies.

Failure modes

  • The interface is up but no route points at it.
  • The route is correct but reverse-path filtering drops replies.
  • NAT rewrites source addresses and breaks policy assumptions.
  • A firewall drop looks like a routing failure.
  • MTU mismatch causes large packets to hang while small probes pass.
  • DNS fails inside the namespace even though raw IP connectivity works.

Practical checks

Run checks at each boundary:

ip netns exec ns ip addr
ip netns exec ns ip route
ip netns exec ns ping -c1 <gateway>
ip route get <destination>
conntrack -L
nft list ruleset

Use packet capture at both ends of a veth pair when a packet disappears. Seeing the packet on one side but not the other narrows the fault to the boundary between them.

Design guidance

Debug by path, not by component name. Identify source namespace, output interface, route, firewall hook, NAT decision, peer interface, and destination namespace. Most container networking bugs become obvious once the exact packet path is written down.

Source anchors