From mboxrd@z Thu Jan 1 00:00:00 1970 From: Florian Westphal Subject: Re: REOUTE target extenstion Date: Wed, 27 May 2015 14:11:30 +0200 Message-ID: <20150527121130.GC23992@breakpoint.cc> References: <20150527113746.GA23992@breakpoint.cc> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: netfilter-devel@vger.kernel.org, Florian Westphal , jengelh@inai.de To: Eddi Linder Return-path: Received: from Chamillionaire.breakpoint.cc ([80.244.247.6]:45734 "EHLO Chamillionaire.breakpoint.cc" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751787AbbE0MLc (ORCPT ); Wed, 27 May 2015 08:11:32 -0400 Content-Disposition: inline In-Reply-To: Sender: netfilter-devel-owner@vger.kernel.org List-ID: Eddi Linder wrote: > TEE is for gateway redirections, which means the redirected device has > to have a configured ip, and to be reachable from the original device. That makes no sense to me. The to-redirected device always needs to be reachable. And iptables is L3 and upwards, so I don't see how 1:1 copying would fit in here. > Florian, I didn't find the mirror target in the mainline documentation or code. I meant the tc action: tc filter add dev eth0 parent $parent protocol ip [..] action mirred egress redirect dev eth1 > REROUTE redirection is more like the openvswitch output action, copy > the packet from one device into another. Sorry, but my feeling is that this is out of scope for iptables.