Sets of virtual machines are connected to a virtual bridges (e.g.
virbr1) and as they are isolated, can use the same subnet range and set of IPs. However, NATing becomes a problem because the host won’t know which VM to return the traffic to.
veth device acts like a patch cable and is actually made up of two network devices, one for each end (e.g.
peer1-b). By adding those interfaces between bridges and/or namespaces, you create a link between them.
The network namespace is only used for NAT and is where the
veth IPs are set, the other end will act like a patch cable without an IP. The VMs are only connected into their respective bridge (e.g.
virbr0) and can talk to the network namespace over the
We will use two pairs for each network namespace.
- One (e.g. represented by
veth1below ) which connects the virtual machine’s private network (e.g.
10.0.0.0/24) into the network namespace (e.g.
net-ns1) where it sets an IP and will be the private network router (e.g.
- Another (e.g. represented by
veth2below) which connects the upstream provider network (e.g.
192.168.0.0/24) into the same network namespace where it sets an IP (e.g.
- Repeat the process for other namespaces (e.g. represented by
By providing each private network with is own unique upstream routable IP and applying NAT rules inside each namespace separately we can avoid any conflict.Continue reading