In this lesson, you will learn how to use veth pairs to create a bidirectional virtual cable that bridges the network isolation between two distinct network namespaces.
The Virtual Patch Cable
A veth (Virtual Ethernet) device is a local Ethernet tunnel. You can think of it as a pair of virtual network interfaces connected by a crossover cable. Anything that enters one end of the pair appears instantly at the other end. Because these devices are Linux kernel primitives, they are the standard mechanism for moving packets across the "walls" of network namespaces—the primary building block for container networking.
Connecting the Namespaces
To establish a tunnel, you create the veth pair in the initial namespace, then move one end into a target namespace. Once the interfaces are assigned to different namespaces and brought "up," they act as a private pipe.
Here is how you bridge that gap:
# 1. Create the pair (veth0 and veth1)
ip link add veth0 type veth peer name veth1
# 2. Move one end to a target namespace (e.g., 'ns1')
ip link set veth1 netns ns1
# 3. Configure IP addresses for both ends
ip addr add 10.0.0.1/24 dev veth0
ip link set veth0 up
# Inside ns1:
ip addr add 10.0.0.2/24 dev veth1
ip link set veth1 up
Bidirectional Flow
Once the interfaces are configured, traffic sent from veth0 is immediately received by veth1 and vice versa. This is "bidirectional" because the kernel handles the packet handoff without needing external hardware or physical drivers. Even though the processes in ns1 are isolated from the host's primary network stack, the veth pair allows them to communicate with the host or other namespaces as if they were physically wired together.
While these pairs create point-to-point connections, they are rarely used alone in complex container setups. Instead, you typically attach one end of the veth pair to a virtual bridge or a routing entity, allowing the container to participate in larger network topologies while maintaining its internal namespace isolation.
Key Takeaway: A veth pair acts as a virtual point-to-point Ethernet wire, providing a bidirectional tunnel that allows packets to traverse the boundaries between isolated network namespaces.