```bash
# Create namespace
sudo ip netns add ts2

# veth pair: host side <-> ns side
sudo ip link add veth-ts2 type veth peer name veth-ts2-ns
sudo ip link set veth-ts2-ns netns ts2

# Host side
sudo ip addr add 10.200.0.1/30 dev veth-ts2
sudo ip link set veth-ts2 up

# Namespace side
sudo ip -n ts2 addr add 10.200.0.2/30 dev veth-ts2-ns
sudo ip -n ts2 link set veth-ts2-ns up
sudo ip -n ts2 link set lo up
sudo ip -n ts2 route add default via 10.200.0.1

# DNS inside the netns
sudo mkdir -p /etc/netns/ts2
echo "nameserver 1.1.1.1" | sudo tee /etc/netns/ts2/resolv.conf

# NAT from the netns out to the world (replace eth0 with your egress iface)
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A POSTROUTING -s 10.200.0.0/30 -o br0 -j MASQUERADE
sudo iptables -A FORWARD -i veth-ts2 -o br0 -j ACCEPT
sudo iptables -A FORWARD -o veth-ts2 -i br0 -m state --state RELATED,ESTABLISHED -j ACCEPT


# quick sanity check
sudo ip netns exec ts2 curl https://controlplane.tailscale.com
# expect: "OK"
```

```bash
# ts2 alias
echo 'alias ts2="sudo ip netns exec ts2 tailscale --socket=/run/tailscale-ts2/tailscaled.sock"' \
  | sudo tee /etc/profile.d/tailscale-ts2.sh
```