Nexus-Guard-Suite/reference/namespace-vrf/quick-reference.md

Namespace + VRF Quick Reference

Kernel Commands Cheat Sheet

Namespace Operations

# List all namespaces
ip netns list

# Create namespace
ip netns add <name>

# Delete namespace
ip netns del <name>

# Execute command in namespace
ip netns exec <name> <command>

# Enter namespace (interactive)
ip netns exec <name> bash

VRF Operations

# Create VRF
ip link add <vrf-name> type vrf table <table-id>

# Up VRF
ip link set <vrf-name> up

# Down VRF
ip link set <vrf-name> down

# Delete VRF
ip link del <vrf-name>

# List VRFs
ip link show type vrf

WireGuard in Namespace

# Create WG interface in namespace
ip netns exec <ns> ip link add <wg-name> type wireguard

# Bind WG to VRF
ip netns exec <ns> ip link set <wg-name> vrf <vrf-name>

# Configure WG
ip netns exec <ns> ip addr add <cidr> dev <wg-name>
ip netns exec <ns> wg set <wg-name> listen-port <port> private-key <key>

# Add routes to VRF table
ip netns exec <ns> ip route add <cidr> dev <wg-name> table <table-id>

nftables in Namespace

# Create table in namespace
ip netns exec <ns> nft add table ip <table-name>

# Create chain
ip netns exec <ns> nft add chain ip <table-name> <chain-name> '{type filter hook forward priority filter; policy accept;}'

# Add rule
ip netns exec <ns> nft add rule ip <table-name> <chain-name> <rule>

# List rules
ip netns exec <ns> nft list table ip <table-name>

# Delete table
ip netns exec <ns> nft delete table ip <table-name>

Common Scenarios

Scenario 1: Create User Namespace with VRF

# 1. Create namespace
ip netns add ns_zerocode

# 2. Create veth pair
ip link add veth-z0 type veth peer name veth-z1
ip link set veth-z1 netns ns_zerocode

# 3. Configure veth in default namespace
ip addr add 10.0.0.1/24 dev veth-z0
ip link set veth-z0 up

# 4. Configure veth in namespace
ip netns exec ns_zerocode ip addr add 10.0.0.2/24 dev veth-z1
ip netns exec ns_zerocode ip link set veth-z1 up
ip netns exec ns_zerocode ip route add default via 10.0.0.1

# 5. Create VRF
ip netns exec ns_zerocode ip link add vrf:main type vrf table 100
ip netns exec ns_zerocode ip link set vrf:main up

# 6. Create WireGuard
ip netns exec ns_zerocode ip link add wg-z-main type wireguard
ip netns exec ns_zerocode ip link set wg-z-main vrf vrf:main

# 7. Configure WireGuard
ip netns exec ns_zerocode ip addr add 10.100.0.1/24 dev wg-z-main
ip netns exec ns_zerocode wg set wg-z-main listen-port 51820 private-key /path/to/key

# 8. Add routes
ip netns exec ns_zerocode ip route add 10.100.0.0/24 dev wg-z-main table 100

Scenario 2: Two Users with Same IP

# User 1: zerocode
ip netns add ns_zerocode
ip netns exec ns_zerocode ip link add vrf:main type vrf table 100
ip netns exec ns_zerocode ip link add wg-z-main type wireguard
ip netns exec ns_zerocode ip link set wg-z-main vrf vrf:main
ip netns exec ns_zerocode ip addr add 10.100.0.1/24 dev wg-z-main

# User 2: alice (SAME IP!)
ip netns add ns_alice
ip netns exec ns_alice ip link add vrf:main type vrf table 100
ip netns exec ns_alice ip link add wg-a-main type wireguard
ip netns exec ns_alice ip link set wg-a-main vrf vrf:main
ip netns exec ns_alice ip addr add 10.100.0.1/24 dev wg-a-main  # SAME IP!

# No conflict - different namespaces!

Scenario 3: Cleanup

# Delete namespace (removes all interfaces, VRFs, etc.)
ip netns del ns_zerocode

# Or manually cleanup
ip netns exec ns_zerocode ip link del wg-z-main
ip netns exec ns_zerocode ip link del vrf:main
ip netns exec ns_zerocode ip link del veth-z1
ip netns del ns_zerocode

Troubleshooting

Check Namespace Exists

ip netns list | grep <name>

Check VRF in Namespace

ip netns exec <name> ip link show type vrf

Check WG Interface in Namespace

ip netns exec <name> wg show

Check Routing Table in VRF

ip netns exec <name> ip route show table <table-id>

Check nftables in Namespace

ip netns exec <name> nft list tables
ip netns exec <name> nft list table ip <table-name>

Debug Connectivity

# Ping from namespace
ip netns exec <name> ping <ip>

# Trace route from namespace
ip netns exec <name> traceroute <ip>

# Capture packets in namespace
ip netns exec <name> tcpdump -i <interface>

Performance Tuning

Increase File Descriptors

# In namespace
ip netns exec <name> ulimit -n 65535

Optimize Kernel Parameters

# In namespace
ip netns exec <name> sysctl -w net.core.rmem_max=16777216
ip netns exec <name> sysctl -w net.core.wmem_max=16777216

Check Resource Usage

# Check namespace resource usage
ls -la /var/run/netns/

# Check VRF resource usage
ip -d link show type vrf

---

Last Updated: 2026-07-10