SNAT vs ip rule

SNAT vs ip rule

[Marc SCHAEFER]

Hello,

Assume a firewall with three network interfaces:

   - enp2s0.300: 193.72.186.130
   - enp2s0.400: 46.140.72.218
   - enp2s0.202: 192.168.202.2

The default route goes through enp2s0.400, however there is another
routing table with default route through enp2s0.300 (table 193).

There is an ip rule from 193.72.186.128/26 with works correctly
directly on the firewall

    ping -I 46.140.72.218 8.8.8.8 # goes to enp2s0.400
    ping -I 193.72.186.130 8.8.8.8 # goes to enp2s0.300

Now, assume a machine 192.168.202.10, on enp2s0.202, with default route
192.168.202.2.

What I want to do:

192.168.202.10% ping 8.8.8.8

   192.168.202.10 gets rewritten with SNAT to 192.72.186.130

   as from 193.72.186.130, ip rule selects default route via enp2s0.300

It does not seem to work: ip rule is ignored, the SNAT works, but the
datagram src=193.72.186.130 is sent on the default route enp2s0.400,
not enp2s0.300.

So, maybe the ip rule is invoked before SNAT?

With iptables, the only solution that worked was using CONNTRACK, mark
and save/restore and an ip rule on the mark.

Is that also the case with nftables?

Thank you.