Linux网桥跨命名空间通信故障：命名空间无法联网及互访

DevOps 小满

2026-5-19

Alright, let's tackle this networking issue step by step. The problem you're facing—namespaces only being able to ping their own addresses—usually stems from missing virtual Ethernet (veth) pairs, incorrect bridge configuration, disabled IP forwarding, or firewall blocks. Let's break down the fixes:

1. Verify & Fix Veth Pair + Bridge Setup

Since you only have one physical NIC, you'll need a bridge in the default namespace to connect your namespaces to the external network. Here's how to set it up properly:

First, check if you already have a bridge and veth pairs configured (run these in the default namespace):

# List network devices to check for bridge (br0) and veth interfaces
ip link show
# Verify if veth pairs are linked to the bridge
bridge link show br0

If missing, create the bridge and veth pairs from scratch:

# 1. Create a bridge and bring it up
ip link add name br0 type bridge
ip link set br0 up

# 2. Bridge your physical NIC (ens192) to br0
# First, flush existing IP from ens192 (we'll assign it to br0 instead)
ip addr flush dev ens192
ip link set ens192 master br0
ip link set ens192 up

# 3. Assign your original ens192 IP to br0 (replace with your actual IP/subnet)
ip addr add 192.168.1.5/24 dev br0
# Set default gateway for the bridge (match your network's gateway)
ip route add default via 192.168.1.1 dev br0

# 4. Create veth pair for NS_NASty
ip link add veth-nas type veth peer name eth0-nas
# Move one end to NS_NASty
ip link set eth0-nas netns NS_NASty
# Attach the other end to br0 and bring it up
ip link set veth-nas master br0
ip link set veth-nas up

# Configure the interface inside NS_NASty
ip netns exec NS_NASty ip link set eth0-nas name eth0
ip netns exec NS_NASty ip link set eth0 up
# Assign a unique IP in the same subnet as br0
ip netns exec NS_NASty ip addr add 192.168.1.10/24 dev eth0
# Set default gateway to br0's IP
ip netns exec NS_NASty ip route add default via 192.168.1.5 dev eth0

# 5. Repeat the same for NS_MongoDB
ip link add veth-mongo type veth peer name eth0-mongo
ip link set eth0-mongo netns NS_MongoDB
ip link set veth-mongo master br0
ip link set veth-mongo up

ip netns exec NS_MongoDB ip link set eth0-mongo name eth0
ip netns exec NS_MongoDB ip link set eth0 up
ip netns exec NS_MongoDB ip addr add 192.168.1.11/24 dev eth0
ip netns exec NS_MongoDB ip route add default via 192.168.1.5 dev eth0

2. Enable IP Forwarding in Default Namespace

The default namespace needs to forward packets between the bridge and physical NIC. Enable it temporarily (and permanently):

# Temporary fix
echo 1 > /proc/sys/net/ipv4/ip_forward

# Permanent fix (survives reboot)
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

3. Check & Adjust Firewall Rules

Firewalls often block inter-namespace or external traffic. Test by temporarily allowing forwarding:

# For iptables
iptables -P FORWARD ACCEPT

# For firewalld (common on RHEL/CentOS)
firewall-cmd --add-masquerade --permanent
firewall-cmd --reload

Once you confirm this works, you can tighten rules to only allow necessary traffic.

4. Fix DNS Resolution in Namespaces

If you can ping IPs but not domains, your namespaces are missing DNS config:

# Copy the default namespace's DNS config to each namespace
mkdir -p /etc/netns/NS_NASty /etc/netns/NS_MongoDB
cp /etc/resolv.conf /etc/netns/NS_NASty/
cp /etc/resolv.conf /etc/netns/NS_MongoDB/

5. Validate Connectivity

Test each requirement to confirm it works:

From NS_NASty/NS_MongoDB: ping 8.8.8.8 (check internet access)
From default namespace: ping 192.168.1.11 (access NS_MongoDB)
From NS_NASty: ping 192.168.1.11 (access NS_MongoDB)

内容的提问来源于stack exchange，提问作者ChaChaPoly