Chapter 69 -- Advanced Linux networking: namespaces, routing, nftables, and packet paths

In one sentence

Linux networking becomes understandable when you trace the packet path through interfaces, routing tables, namespaces, conntrack, firewall rules, and the application socket.

Why this matters

"Network issue" is often a label for very different failures: DNS, routing, firewall, MTU, NAT, conntrack exhaustion, TLS, application backlog, or a service listening on the wrong address. Experts separate those layers quickly.

How it actually works

Core inspection sequence:

ip addr
ip route
ip rule
ss -ltnp
ss -s
resolvectl status 2>/dev/null || cat /etc/resolv.conf
sudo nft list ruleset 2>/dev/null || sudo iptables -S

Packet-path mental model:

   process socket
      -> network namespace
      -> local routing decision
      -> firewall/conntrack/NAT hooks
      -> interface queue
      -> driver/NIC or virtual bridge/veth
      -> remote network

Container networking is the same model with extra namespaces and virtual interfaces. A Kubernetes Pod has its own network namespace; Services add load balancing and NAT/eBPF rules depending on the cluster implementation.

Real-world scenario

An app listens on 127.0.0.1:8080 inside a VM. Health checks from the same host work, but remote traffic fails. ss -ltnp reveals the binding is loopback-only. No firewall change will make another machine reach a socket that is not bound to a routable address.

Try it yourself

Create a network namespace and prove loopback isolation:

sudo ip netns add demo
sudo ip netns exec demo ip link set lo up
sudo ip netns exec demo ip addr
sudo ip netns del demo

Only do namespace and firewall experiments in a disposable lab; a bad firewall rule can lock you out of a remote host.

Common mistakes

Starting with tcpdump before checking ss, ip route, and DNS.
Forgetting that localhost inside a container is the container, not the host.
Treating nftables/iptables rules as the only firewall; cloud security groups, Kubernetes NetworkPolicy, and host firewalls can all participate.
Ignoring MTU when VPNs, overlays, or Kubernetes CNIs are involved.

Check yourself

Why can a service be reachable locally but unreachable remotely?
What does a network namespace isolate?
Why is packet capture powerful but not the first step for every issue?