Virtual Ethernet Pairs

In this lesson, you will learn how to use Virtual Ethernet (veth) pairs to create a virtual tunnel between isolated network namespaces.

The Virtual Patch Cable

Think of a veth pair as a virtual "patch cable" that physically connects two points. In the Linux networking stack, a veth interface always comes in a pair: whatever enters one end of the interface is immediately received by the other end.

By themselves, veth interfaces are not very useful. Their true power emerges when you place each end of the pair into a different network namespace. Because namespaces provide isolated network stacks (independent routing tables, ARP tables, and interface lists), they act as silos. By moving one end of a veth pair into a namespace and keeping the other in the host (or moving it to another namespace), you punch a hole through that isolation, allowing the two environments to communicate at Layer 2.

Setting Up a Connection

To interconnect two namespaces, ns1 and ns2, you perform a simple three-step operation:

1. Create the pair: ip link add veth0 type veth peer name veth1 This creates two linked interfaces, veth0 and veth1.

2. Assign them to namespaces: ip link set veth0 netns ns1 ip link set veth1 netns ns2

3. Configure the endpoints: You must assign IP addresses to these interfaces and set them to "up" within their respective namespaces:

   ip netns exec ns1 ip addr add 10.0.0.1/24 dev veth0
   ip netns exec ns1 ip link set veth0 up
   ip netns exec ns2 ip addr add 10.0.0.2/24 dev veth1
   ip netns exec ns2 ip link set veth1 up
   

Once configured, traffic sent to 10.0.0.2 from ns1 traverses the veth pair directly into ns2 without passing through the physical hardware of your host machine. This mechanism is the foundational building block for container networking; it allows isolated processes to behave as if they are connected to a private, virtual switch, enabling complex microservice architectures while maintaining strict network boundary isolation.

Key Takeaway: Virtual Ethernet pairs act as a virtual bridge between isolated network namespaces, effectively functioning as a dedicated pipe that allows packet transmission between independent network stacks.