conntrack for multiple interfaces

conntrack for multiple interfaces

[Kovesdi Gyorgy]

Hi,

Is there any special mailing list for libnetfiler_conntrack?

My machine has assigned the same IP range for multiple interfaces. Is the 
conntrack able to handle this?

Regards
Gyorgy Kovesdi

Re: conntrack for multiple interfaces

[KOVACS Krisztian]

  Hi,

On Monday 16 January 2006 13.55, Kovesdi Gyorgy wrote:
> Is there any special mailing list for libnetfiler_conntrack?

  I don't think so, you should use netfilter-devel for that purpose.

> My machine has assigned the same IP range for multiple interfaces. Is the
> conntrack able to handle this?

  Conntrack does not care about interfaces at all, so from conntrack's point 
of view having multiple interfaces with the same IP range assigned makes no 
difference.

-- 
 Regards,
  Krisztian Kovacs

Re: conntrack for multiple interfaces

[Balazs Scheidler]

On Mon, 2006-01-16 at 13:55 +0100, Kovesdi Gyorgy wrote:
> Hi,
> 
> Is there any special mailing list for libnetfiler_conntrack?

I don't know of any, I think you can post here.

> 
> My machine has assigned the same IP range for multiple interfaces. Is the 
> conntrack able to handle this?

Conntrack is interface independent, however it does not handle when
tuples collide, it assumes they are part of the same connection. (ie. it
does not work, unless your IP space is actually divided between
interfaces and connections never collide)

-- 
Bazsi

Re: conntrack for multiple interfaces

[Carl-Daniel Hailfinger]

Balazs Scheidler schrieb:
> On Mon, 2006-01-16 at 13:55 +0100, Kovesdi Gyorgy wrote:
> 
>>My machine has assigned the same IP range for multiple interfaces. Is the 
>>conntrack able to handle this?
> 
> Conntrack is interface independent, however it does not handle when
> tuples collide, it assumes they are part of the same connection. (ie. it
> does not work, unless your IP space is actually divided between
> interfaces and connections never collide)

That's unfortunate. IIRC someone posted a patch to netfilter-devel half
a year ago (sorry, no exact date) to address that issue. Was there some
reason not to include it back then?
The only problem with that patch I can think of right now would be load
balancing over multiple links.


Regards,
Carl-Daniel

Re: conntrack for multiple interfaces

[KOVACS Krisztian]

  Hi,

On Tuesday 17 January 2006 12.48, Carl-Daniel Hailfinger wrote:
> > Conntrack is interface independent, however it does not handle when
> > tuples collide, it assumes they are part of the same connection. (ie.
> > it does not work, unless your IP space is actually divided between
> > interfaces and connections never collide)

  Yes, but current mode of operation does work in most cases.

> That's unfortunate. IIRC someone posted a patch to netfilter-devel half
> a year ago (sorry, no exact date) to address that issue. Was there some
> reason not to include it back then?
> The only problem with that patch I can think of right now would be load
> balancing over multiple links.

  Apart from breaking a couple of scenarios, what would be the advantage of 
differentiating connections per interface?

-- 
 Regards,
  Krisztian Kovacs

Re: conntrack for multiple interfaces

[Carl-Daniel Hailfinger]

KOVACS Krisztian schrieb:
>   Hi,
> 
> On Tuesday 17 January 2006 12.48, Carl-Daniel Hailfinger wrote:
> 
>>>Conntrack is interface independent, however it does not handle when
>>>tuples collide, it assumes they are part of the same connection. (ie.
>>>it does not work, unless your IP space is actually divided between
>>>interfaces and connections never collide)
> 
> 
>   Yes, but current mode of operation does work in most cases.
> 
> 
>>That's unfortunate. IIRC someone posted a patch to netfilter-devel half
>>a year ago (sorry, no exact date) to address that issue. Was there some
>>reason not to include it back then?
>>The only problem with that patch I can think of right now would be load
>>balancing over multiple links.
> 
> 
>   Apart from breaking a couple of scenarios, what would be the advantage of 
> differentiating connections per interface?

The scenario of the OP (multiple interfaces with the same IP range) would
work without tuple collisions. And double NAT would be possible as well
with only one machine.


Regards,
Carl-Daniel