Licson Lee says to YSITD
netns + veth pair + iptables NAT