On Sun, Jul 19, 2009 at 12:45:57AM -0400, John A. Sullivan III wrote: > How can one tell iproute2 to distinguish packets from different > vservers before it makes a routing decision? We would like to > establish different routing tables for different vservers but need > to do this before the source address is determined in vservers with how so? > multiple interfaces. It looks like my decision criteria for iproute2 > routing rules are: > to > from > iif (incoming interface) > fwmark > tos and dsfield > To illustrate, let's suppose I have a vserver host with eth0 and tun0. > There are several vservers using eth0. Now imagine a vserver which uses > both interfaces, say eth0=10.1.1.10 and tun0=10.2.2.10 with a default > gateway of 10.1.1.1. Now I want packets destined for 10.3.3.0/24 to use > the 10.2.2.10 source address and the tun0 interface. I do not want any > of the other vservers to see the route to 10.3.3.0/24. that's what multiple routing tables are for > I can do: > ip route add 10.3.3.0/24 via 10.2.2.1 src 10.2.2.10 table special > but the challenge is defining a rule which will apply only to this > special vserver to read the special table. > ip rule add to 10.3.3.0/24 table special prio 1000 > would be read by all vservers and I might as well put the route in the > main table. > ip rule add iif lo or eth0 would be the same. > ip rule from 10.1.1.10 table special pri 1000 > would work but is too late to change the source address since the source > has obviously already been chosen. At least this appears to be the > behavior we observed when we tried this. you could always SNAT it afterwards ... > I could make 10.2.2.10 the primary address but then I have the reverse > problem for where I want to use 10.1.1.10 or when I introduce a third > interface. > I thought of using fwmark but all that does is transfer the problem of > identifying the traffic from a specific vserver to iptables. > So how does one identify traffic from a specific vserver in either > iptables or iproute2 other than by the source IP address? Thanks - John I don't see the problem, do have more than one guest using the same IP? if so, you need a different criterion, otherwise the source IP (whatever it may be) is more than sufficient to identify packets from a specific guest which you can easily use for branching to a separate routing table best, Herbert > -- > John A. Sullivan III > Open Source Development Corporation > +1 207-985-7880 > jsullivan@opensourcedevel.com > > http://www.spiritualoutreach.com > Making Christianity intelligible to secular society