Linux Namespaces & veth Routing
One namespace has nothing but a loopback, and the router namespace drops everything it should route. Diagnose both, live, right below.
Symptom
veth pairs, network namespaces and inter-subnet routing, the primitives Docker and containerlab use to wire every container.
Your mission
Inspect, recover, then verify
Format
Linux shell
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: Linux
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
Two network namespaces are wired together with a veth pair and both interfaces have addresses, but they can't ping each other, and a third namespace on a different subnet is unreachable even after you add a route.
What you'll practice
- Create network namespaces and veth pairs, placing one end in each namespace
- Bring interfaces up and assign addressing correctly
- Route between namespaces on the same subnet
- Enable IP forwarding to route between different subnets
- Relate the setup to how containerlab and Docker build topologies
The topology
Two hosts share a subnet over a veth pair, and a third host sits on a second subnet reachable only through a router namespace that forwards between them, the same veth-and-namespace pattern container runtimes use to connect workloads.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
ip netns listip -n h2 -br linkip -n rtr -br addrip netns exec rtr sysctl net.ipv4.ip_forwardTopology diagram
Fact-checked references
The commands and behaviour in this lab were checked against these primary references.
Frequently asked
Do I need Docker for this?
No. You build the namespaces and veth pairs directly with iproute2, which is exactly what Docker and containerlab do for you behind the scenes.
Is this relevant to RHCSA?
Interfaces, addressing and routing fundamentals underpin RHCSA-level administration, and namespaces are the basis of the container networking you meet on modern RHEL.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.