Newsgroup: it.fan.marco-ditri
Titolo: Real out of band connectivity with network namespaces

This post explains how to configure on a Linux server a second and
totally independent network interface with its own connectivity. It can
be useful to access the server when the regular connectivity is broken.
 
This can happen thanks to network namespaces[0], a virtualization
feature available in recent kernels.
 
We need to create a simple script to be run at boot time which will
create and configure the namespace. First, move in the new namespace
the network interface which will be dedicated to it:
 
ip netns add oob
ip link set eth2 netns oob
 
 
And then configure it as usual with iproute, by executing it in the new
namespace with ip netns exec:
 
ip netns exec oob ip link set lo up
ip netns exec oob ip link set eth2 up
ip netns exec oob ip addr add 
192.168.1.2/24
 dev eth2
ip netns exec oob ip route add default via 192.168.1.1
 
 
The interface must be configured manually because ifupdown does not
support namespaces yet, and it would use the same /run/network/ifstate
file which tracks the interfaces of the main namespace (this is also a
good argument in favour of something persistent like Network
Manager...).
 
Now we can start any daemon in the namespace, just make sure that they
will not interfere with the on-disk state of other instances:
 
ip netns exec oob /usr/sbin/sshd -o PidFile=/run/sshd-oob.pid
 
 
Netfilter is virtualized as well, so we can load a firewall
configuration which will be applied only to the new namespace:
 
ip netns exec oob iptables-restore < /etc/network/firewall-oob-v4
 
 
As documented in ip-netns(8)[1], iproute netns add will also create a
mount namespace and bind mount in it the files in
/etc/netns/$NAMESPACE/: this is very useful since some details of the
configuration, like the name server IP, will be different in the new
namespace:
 
mkdir -p /etc/netns/oob/
echo 'nameserver 8.8.8.8' > /etc/netns/oob/resolv.conf
 
 
If we connect to the second SSH daemon, it will create a shell in the
second namespace. To enter the main one, i.e. the one used by PID 1, we
can use a simple script like:
 
#!/bin/sh -e
exec nsenter --net --mount --target 1 "$@"
 
 
To reach the out of band namespace from the main one we can use
instead:
 
#!/bin/sh -e
exec nsenter --net --mount --target $(cat /var/run/sshd-oob.pid) "$@"
 
 
Scripts like these can also be used in fun ssh configurations like:
 
Host 10.2.1.*
 ProxyCommand ssh -q -a -x -N -T 
server-oob.example.net
 'nsenter-main
nc %h %p'
 
 
 
[0] 
http://lwn.net/Articles/580893/
 
[1] 
http://man7.org/linux/man-pages/man8/ip-netns.8.html
 
 
Permalink: 
http://blog.bofh.it/debian/id_446
 

 be useful to access the server when the regular connectivity is broken.
 
Poi provo a capire se si applica anche a una pennetta umts su un server proprio per uso backup.
 
Giulia
 

Poi provo a capire se si applica anche a una pennetta umts su un server proprio per uso backup.
Sì.
 
-- 
ciao,
Marco

Yes, this is very convenient. I use it to connect to several  VPNs
simultaneously, so that I can work on several networks at the same time (and occasionally I also watch Netflix at the same time, again through an OpenVPN). 
 
I have a script for this, which starts an xterm inside each namespace, instead of an ssh session. I actually substituted the tunctl call inside the script with the new functionality of iproute2, as you suggested (here: 
http://blog.bofh.it/debian/id_379
). I learned this from you, so thanks! 
Now I basically use only ip for just about anything network related. 
 
One question: you can build virtual interfaces on a wifi card with iw, can you do the same with ip? If not, do you know where the difference stems from?

stems from?
macvlan does not work yet on wlan interfaces because the kernel lacks
some code which would be needed to support it.
 
-- 
ciao,
Marco