From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ben Greear Subject: Re: [PATCH 0/3] Make mark-based routing work better with multiple separate networks. Date: Tue, 13 May 2014 09:09:12 -0700 Message-ID: <537243A8.2060007@candelatech.com> References: <1399657021-26082-1-git-send-email-lorenzo@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Cc: Lorenzo Colitti , netdev , JP Abgrall , David Miller , Julian Anastasov , Hannes Frederic Sowa To: sowmini varadhan Return-path: Received: from mail2.candelatech.com ([208.74.158.173]:33654 "EHLO mail2.candelatech.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758086AbaEMQJN (ORCPT ); Tue, 13 May 2014 12:09:13 -0400 In-Reply-To: Sender: netdev-owner@vger.kernel.org List-ID: On 05/13/2014 08:38 AM, sowmini varadhan wrote: > On Tue, May 13, 2014 at 11:28 AM, Lorenzo Colitti wrote: > >> You can't use macvlan if you're not using interfaces that don't have >> MAC addresses such as tun devices, 4G interfaces, and so on. > > So to repeat, "what problem do you need to solve?" You indicated > that > " As described in the patch cover letter, one of the things I'm trying > to do is have fwmarks select between multiple separate networks, which > may be on multiple physical interfaces. I also want applications to be > able to listen for connections from all networks using a single > listening socket. I don't care about network isolation." For what it's worth, we have had good luck doing something similar to the marking rules with a private patch some years ago. Then, we backed that out and ran similar rules based on source/dest ports and IP addrs. You can do these routing tricks using standard kernels, but it is not very efficient because you end up with hundreds or thousands of ip rules. We found this approach much easier to deal with than using namespaces, though when we started namespaces did not even exist so maybe we are biased. If I ever have time to hack on this again, I'd like to optimize the ip rules so that they can be bound to a specific interface so that the cost of having lots of rules is not so high... Thanks, Ben -- Ben Greear Candela Technologies Inc http://www.candelatech.com