Why Use a Network Namespace for the Web Console?
By default, the Web Console listens on the host's network interfaces.
Moving it into a dedicated network namespace provides network-level isolation:
The Web Console has its own IP stack, routing table, and firewall rules — completely separated from the host's production traffic.This feature is available on Artica v4.50 Service Pack 7 or Artica v4.50 Service Pack 6 Hotfix 20260315-01
This is useful when:
- The Web Console must not share ports with production services (e.g., a reverse proxy already uses ports 80/443 on the host).
- You want to expose the admin interface on a different IP address than production services.
- You need fine-grained per-port firewall rules with ipset-based source filtering, independent of the main firewall.
- You want to limit the blast radius of a misconfigured or compromised Web Console — it cannot bind to or sniff host interfaces.
- Regulatory or compliance requirements mandate network segmentation between management and data planes.
¶ Step-by-Step Setup
- Create a Namespace
Create a dedicated namespace for the Web console
- Add a Firewall Rule for Inbound Access
Without a firewall rule, the namespace IP is only reachable from the host itself (through the veth pair).
To allow external clients to reach the Web Console
¶ Bind the service using the Unix console
- Select the Web console menu item
- Select NameSpace menu item.
- Select the namespace you want the web service to bind
¶ Bind the service using the Web console
On the left menu, navigate to Your system > Web Console
- Down to the Listen Interface link.
- Open the configuration and under the Namespace list, choose the defined namespace.
