Sven-Haegar Koch wrote:
On Wed, 6 Aug 2008, Charles Duffy wrote:
Unfortunately, the current behavior of NETMAP -- translating the source
address in POSTROUTING and the destination in PREROUTING -- doesn't appear to
work for this purpose: I still need the original destination intact when
routing to decide which bridge packets should go out.
How do 'yall suggest resolving this?
Perhaps setting a mark based on the destination address at pre-routing,
use netmap, and then route based on the mark?
(Using one routing table a'la 'common-dest/mask -> bridgeX' per mark)
This works only for packets which came in from elsewhere in the network;
packets emitted from the local host don't go through PREROUTING (and
thus can't be marked, and also -- and worse -- don't get their
destinations translated).
Perhaps I could also also add a rule setting an appropriate mark in
OUTPUT. Not being able to communicate with the hosts from the local
system is a showstopper, however, and I'd prefer to avoid munging the
routing tables if possible to keep the patch to libvirt implementing
this functionality minimal. (Robust infrastructure is already in place
for modifying iptables rules for libvirt-managed networks; routing, not
so much).
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
