+usage() {
+ cat <<EOF
+usage: ${0##*/} [OPTS] start|stop NS_NAME
+Setup new or systemd created network namespace with nat and mount namespace
+
+-c, --create Create network namespace. For running outside systemd private net.
+-h, --help Show this help and exit.
+
+From within a systemd network namespace, nat it to the outside. This
+would be called from ExecStartPre, and or subsequent units called with
+JoinsNamespaceOf= and PrivateNetwork=true.
+
+If given -c, or if in the default network namespace, create a named
+network namepace natted to the current netns.
+
+Uses /24 network, finding the first locally unused one starting at
+10.173.0.
+
+Also create a named mount namespace under /root/mount_namespaces, so we
+can alter some system config for this namespace. Subsequent systemd
+command lines would be prefixed with:
+
+/usr/bin/nsenter --mount=/root/mount_namespaces/NS_NAME
+
+Note, this means that they can't run as unpriveledged users, but once
+systemd 233 comes out, it will have a bind mount option from within unit
+files, so the mount namespace won't be needed for most use cases, and I
+will update the script to that the mount namespace not created unless a
+flag is passed in. Patch welcome to add that flag before then.
+
+A recommmended dependency of this script is my other repo named "errhandle",
+which prints stack trace on error, and calls a cleanup function:
+https://iankelling.org/git/?p=errhandle, set ERRHANDLE_PATH, or put it
+in a directory adjacent to the absolute, resolved directory this file is
+in.
+
+Background:
+
+This script does not make the namespace be named like ip does, because
+the naming is not necessary, although it could have been done with some
+more work. For debugging and joining the namespace with a bash shell, I
+use nsenter -n -m -t $(pgrep PROCESS_IN_NAMESPACE). Note: if I knew how
+to easily ask systemd what pid a unit has, i would do that.
+
+"ip netns new ..." also does a mount namespace, then bind
+mounts each file/dir in /etc/netns/NS_NAME to /etc/NS_NAME. Note,
+for openvpn having it's own resolv.conf by using it's user script which
+calls resolvconf, this doesn't help much. What we actually want to do is
+copy /run/resolvconf somehwere then bind mount it on top of
+/run/resolvconf.
+
+Please email me if you have a patches, bugs, feedback, or republish this
+somewhere else: Ian Kelling <ian@iankelling.org>.
+EOF
+ exit ${1:-0}
+}