Building an Isolated Offense-Defense Range with Linux Network Namespaces

When building a homelab to practice attack techniques or write detection rules, standard full-virtualization hypervisors often introduce unnecessary overhead. Running multiple full-featured virtual routers to simulate segmented enterprise networks—such as separating an attacker host, an Active Directory domain, and an out-of-band monitoring station—can consume gigabytes of RAM before launching a single workload.

Using Linux network namespaces (netns) combined with virtual Ethernet (veth) pairs allows you to build a completely isolated, multi-subnet attack range on a single Linux kernel with near-zero overhead. Here is how to construct a reproducible three-zone laboratory using standard iproute2 tooling.

Designing the Namespace Topology

Network namespaces provide isolated instances of the system’s network stack, complete with their own routing tables, firewall rules, and network interfaces.

For this lab, we build three distinct namespaces on a host:

1. ns-attacker: Represents the untrusted/external zone (10.0.10.0/24).
2. ns-victim: Represents the internal target zone (10.0.20.0/24).
3. ns-router: Acts as the inter-zone gateway, performing selective routing and packet capture.

Connecting these namespaces requires veth pairs—virtual pipe interfaces where traffic entering one end immediately exits the other.

Provisioning the Virtual Infrastructure

First, create the network namespaces:

sudo ip netns add ns-attacker
sudo ip netns add ns-victim
sudo ip netns add ns-router

Next, create the veth links connecting the attacker and victim namespaces to the router namespace:

# Attacker <-> Router link
sudo ip link add veth-atk type veth peer name veth-atk-r
sudo ip link set veth-atk netns ns-attacker
sudo ip link set veth-atk-r netns ns-router

# Victim <-> Router link
sudo ip link add veth-vic type veth peer name veth-vic-r
sudo ip link set veth-vic netns ns-victim
sudo ip link set veth-vic-r netns ns-router

Assign IP addresses within each namespace and bring the interfaces up:

# Configure Attacker Zone
sudo ip netns exec ns-attacker ip addr add 10.0.10.2/24 dev veth-atk
sudo ip netns exec ns-attacker ip link set veth-atk up
sudo ip netns exec ns-attacker ip link set lo up
sudo ip netns exec ns-attacker ip route add default via 10.0.10.1

# Configure Victim Zone
sudo ip netns exec ns-victim ip addr add 10.0.20.2/24 dev veth-vic
sudo ip netns exec ns-victim ip link set veth-vic up
sudo ip netns exec ns-victim ip link set lo up
sudo ip netns exec ns-victim ip route add default via 10.0.20.1

# Configure Router Interfaces
sudo ip netns exec ns-router ip addr add 10.0.10.1/24 dev veth-atk-r
sudo ip netns exec ns-router ip addr add 10.0.20.1/24 dev veth-vic-r
sudo ip netns exec ns-router ip link set veth-atk-r up
sudo ip netns exec ns-router ip link set veth-vic-r up
sudo ip netns exec ns-router ip link set lo up

Finally, enable IPv4 packet forwarding inside the router namespace:

sudo ip netns exec ns-router sysctl -w net.ipv4.ip_forward=1

At this stage, 10.0.10.2 can reach 10.0.20.2 through the routing namespace, isolated entirely from your physical local network and the internet.

Tapping Traffic for Detection Engineering

To simulate security telemetry collection without introducing third-party virtual appliances, you can mirror inter-zone traffic using Traffic Control (tc) inside the router namespace.

Create a third interface pair that acts as a sensor tap connected to a passive monitoring namespace:

sudo ip netns add ns-sensor
sudo ip link add veth-tap type veth peer name veth-tap-r
sudo ip link set veth-tap netns ns-sensor
sudo ip link set veth-tap-r netns ns-router

sudo ip netns exec ns-sensor ip link set veth-tap up
sudo ip netns exec ns-sensor ip link set lo up
sudo ip netns exec ns-router ip link set veth-tap-r up

Now, mirror all inbound packets on the router’s victim-facing interface directly to the sensor interface using tc:

# Add ingress qdisc on router's victim interface
sudo ip netns exec ns-router tc qdisc add dev veth-vic-r handle 1: ingress

# Mirror all incoming traffic from victim zone to the sensor tap
sudo ip netns exec ns-router tc filter add dev veth-vic-r parent 1: protocol ip u32 \
    match u32 0 0 action mirred egress mirror dev veth-tap-r

You can now run packet analyzers inside ns-sensor listening on veth-tap. Every frame traveling between the attacker and victim network will be cloned silently into your sensor namespace without disrupting traffic flow.

Key Takeaways

Using Linux native networking primitives provides several distinct advantages for security testing:

• Resource Efficiency: A full multi-subnet topology uses virtually zero idle RAM and CPU.
• Hermetic Isolation: Interfaces exist in separate stack spaces, preventing accidental leakages onto your home network.
• Reproducibility: The entire range can be defined in a simple shell script, brought up instantly, and purged cleanly with ip netns delete.

This setup serves as an ideal lightweight foundation for testing exploit payloads, building custom packet parsers, or validating detection logic across subnet boundaries.

Photo by Sebastian Bednarek on Unsplash.