In this lesson, you will learn how to configure isolated IPv6 stacks within network namespaces to enable neighbor discovery and address assignment without relying on global network state.
The Mechanics of IPv6 in Namespaces
When you create a new network namespace, you receive a fresh IPv6 stack that is entirely isolated from the host. Unlike IPv4, which relies heavily on DHCP, IPv6 was designed with "statelessness" in mind. Within an isolated namespace, a container must handle its own Neighbor Discovery Protocol (NDP) and address assignment, as it cannot see the host’s Router Advertisements (RA) by default.
To establish connectivity, you typically pair a veth device inside the namespace with one on the host. Because each namespace acts as an independent network layer, the kernel treats the namespace’s veth interface as a local link.
Implementing NDP and SLAAC
To perform Stateless Address Autoconfiguration (SLAAC) within a namespace, the interface must be "up" and the IPv6 protocol must be enabled. If you are not running a custom daemon, you can manually assign a link-local address or a Global Unicast Address (GUA) to verify the stack:
# Inside the network namespace
ip link set veth1 up
# Assign a GUA address
ip -6 addr add 2001:db8:1::2/64 dev veth1
# Verify the neighbor table
ip -6 neigh show
The core challenge is that the Neighbor Solicitation (NS) packets sent by your namespace will reach the host bridge, but the host will not automatically reply unless the bridge is configured to act as a router or an NDP proxy. You must ensure the host kernel allows forwarding for the specific interface:
# On the host
sysctl -w net.ipv6.conf.all.forwarding=1
# Ensure the proxy_ndp flag is enabled if you aren't using a bridge
sysctl -w net.ipv6.conf.veth0.proxy_ndp=1
By enabling proxy_ndp and allowing forwarding, the host facilitates the neighbor discovery process, allowing the isolated stack to resolve the link-layer addresses of external gateways. Without this, your namespace will remain unable to resolve the path to the outside world, as its internal NDP packets will effectively vanish into the virtual link.
Key Takeaway: IPv6 in namespaces requires explicit configuration of NDP proxying and forwarding on the host, as the isolated stack cannot perform autonomous discovery across the veth boundary without these bridge or routing primitives.