Re: New match ipt_nexthop

[Samuel Jean <sj-netfilter@cookinglinux.org>]

Patrick McHardy wrote:

>>
>>
>> Bad and good comments are welcome!
>
>
>
> We already have the realm match in the kernel, which matches the
> routing realms. Is there anything you can't do with the realm
> match but with your new match ?

No, there isn't.
The realm match seems to do much more than what this new match can.
However, nexthop match doesn't require those realms routing keys and is
quite simple to set up.

router A : 192.168.0.1
router B : 192.168.0.2

iptables -A FORWARD -m nexthop --nexthop-ip 192.168.0.1 -j LOG 
--log-prefix "Processed by A: "
iptables -A FORWARD -m nexthop --nexthop-ip 192.168.0.2 -j LOG 
--log-prefix "Processed by B: "

I think it's not a question of functionnality, but simplicity.

Conclusion, I find this new match useless being given that realm match 
can all do that.

>
> Regards
> Patrick
>
>
Cheers,

Samuel Jean
CookingLinux.org