Network Function Virtualization with Linux Namespaces

AdvancedNetworking~6 hours
NFVnamespacesvethHAProxy

I virtualized network functions – a router, a firewall, and a load balancer – as isolated Linux network namespaces connected by veth pairs, then chained them into a single service path. Running VNFs in software on commodity hardware replaced dedicated appliances for the lab fabric.

Objective & Context

NFV decouples network functions from proprietary hardware, running them as software instances that can be chained into service function paths. This lab uses namespaces as lightweight VNFs and HAProxy as a virtual load balancer, the same primitives behind container networking.

Environment & Prerequisites

  • Linux host with iproute2, nftables, and HAProxy.
  • Privileges to create namespaces and veth pairs.
  • Two backend services to balance.

Step-by-Step Execution

1. Create VNF namespaces and link them [PRIVILEGED]

ip netns add fw && ip netns add lb && ip link add veth-fw type veth peer name veth-lb

2. Run a firewall VNF in its namespace

ip netns exec fw nft add rule inet filter forward tcp dport 80 accept

3. Run HAProxy as the load-balancer VNF

ip netns exec lb haproxy -f /etc/haproxy/lb.cfg
backend web  server b1 10.0.0.11:80 check  server b2 10.0.0.12:80 check
Proxy web started.

Validation & Testing

Send requests through the chain and confirm they traverse firewall then load balancer and distribute across backends. Pass criteria: only permitted traffic passes the firewall VNF and load is shared across both backends.

Advanced: Troubleshooting
  • No traffic between namespaces: assign IPs to both veth ends and bring them up.
  • HAProxy bind fails: confirm it binds inside the namespace, not the host.
  • Forwarding blocked: enable forwarding within the namespace.

Key Results

  • Chained 3 virtual network functions into a single service path.
  • Replaced dedicated appliances with software VNFs on commodity hardware.
  • Load-balanced traffic across 2 backends through the HAProxy VNF.
  • Isolated each function in its own namespace for clean teardown.

Related Labs