Re: ip_conntrack_tuple and marks

[Martijn Lievaart <m@rtij.nl>]

Carl-Daniel Hailfinger wrote:

>No, they are not. Let me explain:
>The box in question has two pairs of interfaces.
>eth0: 10.0.0.254/24   eth1: 10.0.1.254/24
>eth2: 10.0.0.254/24   eth3: 10.0.1.254/24
>I want to do routing and firewalling between eth0 and eth1. That's
>simple. However, I also want to do routing and filtering between
>eth2 and eth3. Although eth0 and eth2 have the same subnet, they
>are NOT the same network, they just happen to have identical
>configurations. Same goes for eth1 and eth3.
>  
>

OK, it's clear to me now. I don't think you can achieve that with 
current netfilter connection tracking.

>/\/\/\/\/\/\/\/\    +------+   /\/\/\/\/\/\/\/\
>\              /    |      |   \              /
> | 10.0.0.0/24 |---eth0  eth1---| 10.0.1.0/24 |
>/              \    |      |   /              \
>\/\/\/\/\/\/\/\/    +------+   \/\/\/\/\/\/\/\/
>
>
>/\/\/\/\/\/\/\/\    +------+   /\/\/\/\/\/\/\/\
>\              /    |      |   \              /
> | 10.0.0.0/24 |---eth2  eth3---| 10.0.1.0/24 |
>/              \    |      |   /              \
>\/\/\/\/\/\/\/\/    +------+   \/\/\/\/\/\/\/\/
>  
>

Why not do it exactly like that, but with two real boxes? Makes 
interconnecting later also a nobrainer (NETMAP).

M4