In this lesson, you will learn how to leverage Linux network namespaces to apply distinct, isolated firewall policies for individual tenants.
In a multi-tenant environment, relying on a single global firewall configuration is dangerous and difficult to scale. If two tenants share the same host, a single misconfiguration in your global nftables ruleset could expose Tenant A’s traffic to Tenant B. To prevent this, we move firewalling from the global context into dedicated network namespaces.
Isolating Traffic with Namespaces
A network namespace acts as a complete, isolated network stack, including its own loopback device, routing table, and, crucially, its own instance of the Netfilter hooks. When you create a namespace, the kernel essentially gives that tenant their own "sandbox." Any rules you add to the nftables or iptables configuration inside that namespace stay confined to that namespace’s traffic.
Practical Implementation
To apply tenant-specific rules, you first spawn a namespace and then execute your firewall commands within that context using ip netns exec.
Suppose you have a tenant named tenant_alpha and you want to ensure they can only access specific web services:
# Create the namespace for the tenant
ip netns add tenant_alpha
# Define a strict policy inside that specific namespace
ip netns exec tenant_alpha nft add table inet filter
ip netns exec tenant_alpha nft add chain inet filter input { type filter hook input priority 0 \; }
ip netns exec tenant_alpha nft add rule inet filter input tcp dport 80 accept
ip netns exec tenant_alpha nft add rule inet filter input drop
By defining these rules inside tenant_alpha, you guarantee that even if the host's primary firewall is updated or reset, the specific traffic constraints for that tenant remain intact. This prevents "leaky" configurations where one tenant's security posture accidentally overlaps with another’s. Because the nftables instance is per-namespace, the kernel manages these rule sets independently, ensuring that packets belonging to one tenant are evaluated only against the firewall rules that govern their specific environment.
Key Takeaway: By binding firewall rule sets to network namespaces, you create a hard boundary that prevents cross-tenant interference and ensures strict security isolation at the kernel stack level.