How to Use the ip netns Command in Linux to Create and Manage Isolated Network Namespaces

Modern Linux container technologies like Docker, Kubernetes (CNI plugins), and LXC rely on kernel namespaces to isolate system resources. Among the most critical primitives is the Network Namespace (netns). Managed via the ip netns command-line utility from the iproute2 suite, network namespaces provide complete logical copies of the entire networking stack—including private routing tables, iptables/nftables firewall rules, loopback adapters, and socket lists. Using ip netns, engineers can simulate complex multi-node network topologies, test isolated VPN tunnels, and audit services without external virtualization.

Understanding Linux Network Namespace Architecture

By default, all Linux processes share the global root network namespace. When you spawn an isolated network namespace:

• Private Routing Tables: The namespace maintains its own default gateways and routing metrics, completely decoupled from the host network.
• Independent Interface Space: Physical or virtual network interfaces assigned to a namespace become completely invisible to the host operating system.
• Isolated Loopback: The namespace has its own 127.0.0.1 local loopback adapter. A web server listening on port 80 inside the namespace will not conflict with a web server listening on port 80 on the host.

Creating and Listing Network Namespaces

Managing network namespaces requires root privileges or the CAP_NET_ADMIN capability. To create a new isolated namespace named ns-production:

sudo ip netns add ns-production

Kernel namespaces added via ip netns are persisted as bind mounts under /var/run/netns/.

To list all active network namespaces on the machine:

ip netns list

The terminal outputs all registered namespace identifiers alongside their internal kernel IDs.

Executing Commands Inside a Network Namespace (ip netns exec)

To run any network utility or daemon inside the isolated environment, prefix the command with ip netns exec [Name]:

sudo ip netns exec ns-production ip addr show

Notice that initially, only the loopback (lo) interface exists, and it is in a DOWN state. Bring up the internal loopback adapter:

sudo ip netns exec ns-production ip link set dev lo up

To spawn an interactive root shell completely enclosed within the namespace context:

sudo ip netns exec ns-production bash

Any command executed within this shell session (e.g., curl, ping, ss -tuln) operates strictly within the isolated network namespace.

Connecting Namespaces to the Host Using Virtual Ethernet Pairs (veth)

Because namespaces are completely isolated, establishing communication with the host or external internet requires a veth pair (virtual Ethernet cable). One end connects to the host root namespace, while the peer end resides inside the target namespace.

Create a veth pair on the host:

sudo ip link add veth-host type veth peer name veth-ns

Move the veth-ns endpoint into the ns-production namespace:

sudo ip link set veth-ns netns ns-production

Assign IP subnets and bring both interfaces up:

# Configure host endpoint
sudo ip addr add 10.200.1.1/24 dev veth-host
sudo ip link set veth-host up

# Configure namespace endpoint
sudo ip netns exec ns-production ip addr add 10.200.1.2/24 dev veth-ns
sudo ip netns exec ns-production ip link set veth-ns up

Verify connectivity by pinging across the virtual link:

sudo ip netns exec ns-production ping -c 3 10.200.1.1

Configuring Default Gateway Routing and Internet NAT

To allow the isolated namespace to reach external internet subnets, configure a default gateway pointing to the host veth IP:

sudo ip netns exec ns-production ip route add default via 10.200.1.1 dev veth-ns

On the host, enable IPv4 packet forwarding and add an iptables MASQUERADE NAT rule for the host’s primary egress interface (e.g., eth0):

sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A POSTROUTING -s 10.200.1.0/24 -o eth0 -j MASQUERADE

Deleting Network Namespaces Cleanly

When testing is finished, delete the namespace:

sudo ip netns delete ns-production

Deleting a namespace automatically destroys any assigned veth interfaces, unbinds the filesystem mount in /var/run/netns/, and terminates associated child sockets.

Essential ip netns Command Reference

Command Syntax	Operational Role
ip netns add [Name]	Instantiates a new isolated network namespace.
ip netns list	Lists all active namespaces and associated process IDs.
ip netns exec [Name] [Cmd]	Executes a specific command inside the namespace context.
ip link set [Dev] netns [Name]	Transfers a physical or virtual network interface into a namespace.
ip netns identify [PID]	Displays the network namespace assigned to a given process PID.
ip netns delete [Name]	Tears down and purges a named network namespace.