Namespaces in operation, part 4: more on PID namespaces

You can setup iptables inside the network namespace, if you trust the program not to change it, you'll be fine.

This is because I'm not sure how well you can control what packets can and can not be send from the network namespace from the parent namespace.