-
-
Save kheminw/559872b0a20829c016325d7ea8192a2a to your computer and use it in GitHub Desktop.
Setup a network namespace with Internet access
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env bash | |
set -x | |
NS="ns1" | |
VETH="veth1" | |
VPEER="vpeer1" | |
VETH_ADDR="10.200.1.1" | |
VPEER_ADDR="10.200.1.2" | |
if [[ $EUID -ne 0 ]]; then | |
echo "You must be root to run this script" | |
exit 1 | |
fi | |
# Remove namespace if it exists. | |
ip netns del $NS &>/dev/null | |
# Create namespace | |
ip netns add $NS | |
# Create a network bridge for our container | |
brctl addbr ${BRIDGE_NAME} | |
ip link set ${BRIDGE_NAME} up | |
ip addr add ${VETH_ADDR}/24 dev ${BRIDGE_NAME} | |
# Create veth link. | |
ip link add name ${VETH} type veth peer name ${VPEER} | |
ip link set ${VETH} up | |
brctl addif ${BRIDGE_NAME} ${VETH} | |
# Add peer-1 to NS. | |
ip link set ${VPEER} netns $NS | |
# Setup IP ${VPEER}. | |
ip netns exec $NS ip addr add ${VPEER_ADDR}/24 dev ${VPEER} | |
ip netns exec $NS ip link set ${VPEER} up | |
ip netns exec $NS ip link set lo up | |
ip netns exec $NS ip route add default via ${VETH_ADDR} | |
# Enable IP-forwarding. | |
echo 1 > /proc/sys/net/ipv4/ip_forward | |
# Flush forward rules. | |
iptables -P FORWARD DROP | |
iptables -F FORWARD | |
# Flush nat rules. | |
iptables -t nat -F | |
# Enable masquerading of 10.200.1.0. | |
iptables -t nat -A POSTROUTING -s ${VPEER_ADDR}/24 -o eth0 -j MASQUERADE | |
iptables -A FORWARD -i eth0 -o ${VETH} -j ACCEPT | |
iptables -A FORWARD -o eth0 -i ${VETH} -j ACCEPT | |
# Get into namespace | |
ip netns exec ${NS} /bin/bash --rcfile <(echo "PS1=\"${NS}> \"") |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment