Re: [PATCH] iptables gateway match

[Patrick McHardy <kaber@trash.net>]

Amin Azez wrote:
> Patrick McHardy wrote:
> 
>> I'm wondering whether we really need a new match for this. It should
>> be possible to do the same using routing realms and the realm match.
>>   
> 
> It's possible that it could be managed using realms, but THAT would be a
> hack, and one very hard for rule generating systems to use, especially
> if realms were already in use.


I don't consider that this a hack. Its even more useful since you
can do masked matches. I also don't see the problem for generated
rules, in fact I used them for exactly this (and other) purpose
in a rule generating system.

> The match as used here is purely for ip<->ip routing compatability, easy
> auto generation of SNATing rules when the next hop router doesn't have a
> reverse route.
> 
> It's also useful for collecting per-gateway statistics (esp. with load
> balancing) and debugging complex routing.
> 
> It will also be useful to most people who won't or can't bend realms to
> their will.
> 
> I don't know if realms will help in the load balancing routing case anyway.


Yes, you can use one realm per nexthop.