Solutions — Lesson 02

Worked answers for the homework tasks

Task 1 — Solution

sudo ip route add 10.20.0.0/16 via 192.168.1.254 dev eth0
ip route get 10.20.5.5
# Expected: 10.20.5.5 via 192.168.1.254 dev eth0 src 192.168.1.50 ...
sudo ip route del 10.20.0.0/16
ip route get 10.20.5.5
# Expected: now resolves via the default route

Task 2 — Solution (client → router → server)

# 1. Namespaces
sudo ip netns add ns-client
sudo ip netns add ns-router
sudo ip netns add ns-server

# 2. Two veth pairs
sudo ip link add veth0 type veth peer name veth1
sudo ip link add veth2 type veth peer name veth3

# Move ends into the right namespaces
sudo ip link set veth0 netns ns-client
sudo ip link set veth1 netns ns-router
sudo ip link set veth2 netns ns-router
sudo ip link set veth3 netns ns-server

# 3. IPs and link state
sudo ip -n ns-client addr add 10.0.1.10/24 dev veth0
sudo ip -n ns-router addr add 10.0.1.1/24  dev veth1
sudo ip -n ns-router addr add 10.0.2.1/24  dev veth2
sudo ip -n ns-server addr add 10.0.2.10/24 dev veth3
for ns in ns-client ns-router ns-server; do
  sudo ip -n $ns link set lo up
done
sudo ip -n ns-client link set veth0 up
sudo ip -n ns-router link set veth1 up
sudo ip -n ns-router link set veth2 up
sudo ip -n ns-server link set veth3 up

# 4. Enable forwarding ON THE ROUTER namespace specifically
sudo ip netns exec ns-router sysctl -w net.ipv4.ip_forward=1

# 5. Default routes — client and server both point at the router
sudo ip -n ns-client route add default via 10.0.1.1
sudo ip -n ns-server route add default via 10.0.2.1

# 6. Ping!
sudo ip netns exec ns-client ping -c 3 10.0.2.10
# Expected: 0% packet loss

# 7. (in another terminal) Capture on the router
sudo ip netns exec ns-router tcpdump -i any icmp
# Expected: see ICMP echo-request on veth1 then on veth2,
# and echo-reply on veth2 then on veth1 — for every ping.

Common mistakes

• Forgot to enable forwarding — net.ipv4.ip_forward=1 must be set inside the router namespace, not on the host. Without it, the router drops transit packets.
• Forgot the return route — ns-server needs a default route back to 10.0.2.1. Without it, the echo-reply has nowhere to go and you'll see only one-way traffic in tcpdump.
• Forgot to bring up lo — required for many local sockets; safest to do it in every namespace.
• Used the host's ip route instead of ip -n ns-... route — easy slip; the host's table doesn't apply inside a namespace.