Linux network namespaces provide genuine, kernel-level network isolation — each namespace has its own interfaces, routing tables, and firewall rules, completely separate from other namespaces. This guide covers practical use on a VPS.
What Network Namespaces Provide
A network namespace is a genuinely isolated network stack — processes within it see only the interfaces, routes, and firewall rules assigned to that namespace, unable to directly access the host's or other namespaces' networking at all, a stronger isolation boundary than firewall rules alone provide.
Why This Matters Beyond Docker's Own Namespace Usage
Docker containers already use network namespaces internally — but understanding and manually working with namespaces directly is useful for scenarios needing custom network isolation outside a full container runtime, or for genuinely understanding what's happening underneath Docker's networking abstraction.
Creating a New Network Namespace
sudo ip netns add isolated-nsListing Network Namespaces
ip netns listRunning a Command Within a Namespace
sudo ip netns exec isolated-ns ip addr showNotice this shows essentially no network interfaces — a new namespace starts genuinely isolated, with only a loopback interface by default; no connectivity to anything until explicitly configured.
Creating a Virtual Ethernet Pair to Connect the Namespace
sudo ip link add veth0 type veth peer name veth1
sudo ip link set veth1 netns isolated-nsA veth pair acts like a virtual network cable — one end stays in the host namespace, the other end moves into the isolated namespace, providing the actual connectivity path between them.
Assigning IP Addresses and Bringing Interfaces Up
sudo ip addr add 10.0.0.1/24 dev veth0
sudo ip link set veth0 up
sudo ip netns exec isolated-ns ip addr add 10.0.0.2/24 dev veth1
sudo ip netns exec isolated-ns ip link set veth1 up
sudo ip netns exec isolated-ns ip link set lo upTesting Connectivity Between Host and Namespace
ping 10.0.0.2Running a Process Genuinely Isolated Within the Namespace
sudo ip netns exec isolated-ns python3 -m http.server 8000A process run this way only has access to the namespace's specific network configuration — it cannot see or bind to the host's other network interfaces, a genuine isolation boundary rather than just a firewall restriction.
Restricting Outbound Access from a Namespace
Combine with iptables rules applied specifically within the namespace (using ip netns exec isolated-ns iptables ...) for fine-grained control over what the isolated process can actually reach, even beyond the basic namespace isolation itself.
Practical Use Case: Isolating an Untrusted Process
For running a genuinely untrusted or high-risk process (processing untrusted input, for example), network namespace isolation provides a meaningful additional security boundary beyond standard user/permission isolation, similar in spirit to How to Set Up Network Segmentation on a Single VPS but at the kernel primitive level.
Cleaning Up a Namespace
sudo ip netns delete isolated-nsCommon Errors
No connectivity from the namespace despite correct IP configuration — verify both ends of the veth pair are actually up (ip link set ... up on both sides), and that IP forwarding is enabled on the host if the namespace needs to reach beyond just the host itself.
Continue Reading
- How to Set Up Network Segmentation on a Single VPS
- Docker Networking Explained: Bridge, Host & Custom Networks
- How to Implement the Principle of Least Privilege on a Linux VPS
Browse more articles in Advanced Networking & VPN.
