Re: [PATCH 0/3] Make mark-based routing work better with multiple separate networks.

[Ben Greear <greearb@candelatech.com>]

On 05/13/2014 08:38 AM, sowmini varadhan wrote:
> On Tue, May 13, 2014 at 11:28 AM, Lorenzo Colitti <lorenzo@google.com> wrote:
> 
>> You can't use macvlan if you're not using interfaces that don't have
>> MAC addresses such as tun devices, 4G interfaces, and so on.
> 
> So to repeat, "what problem do you need to solve?" You indicated
> that
> " As described in the patch cover letter, one of the things I'm trying
>   to do is have fwmarks select between multiple separate networks, which
>   may be on multiple physical interfaces. I also want applications to be
>   able to listen for connections from all networks using a single
>   listening socket. I don't care about network isolation."

For what it's worth, we have had good luck doing something similar to the
marking rules with a private patch some years ago.  Then, we backed that out
and ran similar rules based on source/dest ports and IP addrs.  You can do these
routing tricks using standard kernels, but it is not very efficient because you
end up with hundreds or thousands of ip rules.

We found this approach much easier to deal with than using namespaces, though
when we started namespaces did not even exist so maybe we are biased.

If I ever have time to hack on this again, I'd like to optimize the ip rules
so that they can be bound to a specific interface so that the cost of having
lots of rules is not so high...


Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com