Nexus-Guard-Suite/reference/namespace-vrf/quick-reference.md

# Namespace + VRF Quick Reference

## Kernel Commands Cheat Sheet

### Namespace Operations

```bash
# List all namespaces
ip netns list

# Create namespace
ip netns add <name>

# Delete namespace
ip netns del <name>

# Execute command in namespace
ip netns exec <name> <command>

# Enter namespace (interactive)
ip netns exec <name> bash
```

### VRF Operations

```bash
# Create VRF
ip link add <vrf-name> type vrf table <table-id>

# Up VRF
ip link set <vrf-name> up

# Down VRF
ip link set <vrf-name> down

# Delete VRF
ip link del <vrf-name>

# List VRFs
ip link show type vrf
```

### WireGuard in Namespace

```bash
# Create WG interface in namespace
ip netns exec <ns> ip link add <wg-name> type wireguard

# Bind WG to VRF
ip netns exec <ns> ip link set <wg-name> vrf <vrf-name>

# Configure WG
ip netns exec <ns> ip addr add <cidr> dev <wg-name>
ip netns exec <ns> wg set <wg-name> listen-port <port> private-key <key>

# Add routes to VRF table
ip netns exec <ns> ip route add <cidr> dev <wg-name> table <table-id>
```

### nftables in Namespace

```bash
# Create table in namespace
ip netns exec <ns> nft add table ip <table-name>

# Create chain
ip netns exec <ns> nft add chain ip <table-name> <chain-name> '{type filter hook forward priority filter; policy accept;}'

# Add rule
ip netns exec <ns> nft add rule ip <table-name> <chain-name> <rule>

# List rules
ip netns exec <ns> nft list table ip <table-name>

# Delete table
ip netns exec <ns> nft delete table ip <table-name>
```

## Common Scenarios

### Scenario 1: Create User Namespace with VRF

```bash
# 1. Create namespace
ip netns add ns_zerocode

# 2. Create veth pair
ip link add veth-z0 type veth peer name veth-z1
ip link set veth-z1 netns ns_zerocode

# 3. Configure veth in default namespace
ip addr add 10.0.0.1/24 dev veth-z0
ip link set veth-z0 up

# 4. Configure veth in namespace
ip netns exec ns_zerocode ip addr add 10.0.0.2/24 dev veth-z1
ip netns exec ns_zerocode ip link set veth-z1 up
ip netns exec ns_zerocode ip route add default via 10.0.0.1

# 5. Create VRF
ip netns exec ns_zerocode ip link add vrf:main type vrf table 100
ip netns exec ns_zerocode ip link set vrf:main up

# 6. Create WireGuard
ip netns exec ns_zerocode ip link add wg-z-main type wireguard
ip netns exec ns_zerocode ip link set wg-z-main vrf vrf:main

# 7. Configure WireGuard
ip netns exec ns_zerocode ip addr add 10.100.0.1/24 dev wg-z-main
ip netns exec ns_zerocode wg set wg-z-main listen-port 51820 private-key /path/to/key

# 8. Add routes
ip netns exec ns_zerocode ip route add 10.100.0.0/24 dev wg-z-main table 100
```

### Scenario 2: Two Users with Same IP

```bash
# User 1: zerocode
ip netns add ns_zerocode
ip netns exec ns_zerocode ip link add vrf:main type vrf table 100
ip netns exec ns_zerocode ip link add wg-z-main type wireguard
ip netns exec ns_zerocode ip link set wg-z-main vrf vrf:main
ip netns exec ns_zerocode ip addr add 10.100.0.1/24 dev wg-z-main

# User 2: alice (SAME IP!)
ip netns add ns_alice
ip netns exec ns_alice ip link add vrf:main type vrf table 100
ip netns exec ns_alice ip link add wg-a-main type wireguard
ip netns exec ns_alice ip link set wg-a-main vrf vrf:main
ip netns exec ns_alice ip addr add 10.100.0.1/24 dev wg-a-main  # SAME IP!

# No conflict - different namespaces!
```

### Scenario 3: Cleanup

```bash
# Delete namespace (removes all interfaces, VRFs, etc.)
ip netns del ns_zerocode

# Or manually cleanup
ip netns exec ns_zerocode ip link del wg-z-main
ip netns exec ns_zerocode ip link del vrf:main
ip netns exec ns_zerocode ip link del veth-z1
ip netns del ns_zerocode
```

## Troubleshooting

### Check Namespace Exists

```bash
ip netns list | grep <name>
```

### Check VRF in Namespace

```bash
ip netns exec <name> ip link show type vrf
```

### Check WG Interface in Namespace

```bash
ip netns exec <name> wg show
```

### Check Routing Table in VRF

```bash
ip netns exec <name> ip route show table <table-id>
```

### Check nftables in Namespace

```bash
ip netns exec <name> nft list tables
ip netns exec <name> nft list table ip <table-name>
```

### Debug Connectivity

```bash
# Ping from namespace
ip netns exec <name> ping <ip>

# Trace route from namespace
ip netns exec <name> traceroute <ip>

# Capture packets in namespace
ip netns exec <name> tcpdump -i <interface>
```

## Performance Tuning

### Increase File Descriptors

```bash
# In namespace
ip netns exec <name> ulimit -n 65535
```

### Optimize Kernel Parameters

```bash
# In namespace
ip netns exec <name> sysctl -w net.core.rmem_max=16777216
ip netns exec <name> sysctl -w net.core.wmem_max=16777216
```

### Check Resource Usage

```bash
# Check namespace resource usage
ls -la /var/run/netns/

# Check VRF resource usage
ip -d link show type vrf
```

---

**Last Updated**: 2026-07-10