kentonv: Backlogging, you can in fact do tun and then pass the created netdev into a namespace. See "ip link set dev <device> netns <pid>"