Re: conntrack for multiple interfaces

[Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>]

KOVACS Krisztian schrieb:
>   Hi,
> 
> On Tuesday 17 January 2006 12.48, Carl-Daniel Hailfinger wrote:
> 
>>>Conntrack is interface independent, however it does not handle when
>>>tuples collide, it assumes they are part of the same connection. (ie.
>>>it does not work, unless your IP space is actually divided between
>>>interfaces and connections never collide)
> 
> 
>   Yes, but current mode of operation does work in most cases.
> 
> 
>>That's unfortunate. IIRC someone posted a patch to netfilter-devel half
>>a year ago (sorry, no exact date) to address that issue. Was there some
>>reason not to include it back then?
>>The only problem with that patch I can think of right now would be load
>>balancing over multiple links.
> 
> 
>   Apart from breaking a couple of scenarios, what would be the advantage of 
> differentiating connections per interface?

The scenario of the OP (multiple interfaces with the same IP range) would
work without tuple collisions. And double NAT would be possible as well
with only one machine.


Regards,
Carl-Daniel