<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - nftables - dynamic update for verdict map from the packet path"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1736#c6">Comment # 6</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - nftables - dynamic update for verdict map from the packet path"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1736">bug 1736</a>
from <span class="vcard"><a class="email" href="mailto:pablo@netfilter.org" title="Pablo Neira Ayuso <pablo@netfilter.org>"> <span class="fn">Pablo Neira Ayuso</span></a>
</span></b>
<pre>(In reply to dinhtrason from <a href="show_bug.cgi?id=1736#c4">comment #4</a>)
<span class="quote">> > Are you fully using the 32 bits in the mark _only_ for masquerading?
>
> No, masquerading takes one bit of the packet mark. The location of the bit
> however is not fixed (i.e. it is a configuration option), making the usage
> of meta mark is even more difficult. </span >
Can you use the conntrack mark (instead of the packet mark)?
Looking at your ruleset, that makes sense to me, because this also allows to
debug via `conntrack -L' what endpoint has being selected for a given flow,
also for netfilter logging as well as `conntrack -E' for event reporting.
<span class="quote">> You can refer to masqueradeBit in the link for more details.
> <a href="https://kubernetes.io/docs/reference/config-api/kube-proxy-config.v1alpha1/">https://kubernetes.io/docs/reference/config-api/kube-proxy-config.v1alpha1/</a>
> #kubeproxy-config-k8s-io-v1alpha1-KubeProxyNFTablesConfiguration
>
> >
> > If you use conntrack, then can you use connlabel?
> >
>
> No, conntrack is not used in the context of this chain.</span >
You do use conntrack, because I can see 'dnat to' is used in your ruleset after
the endpoint is selected based on the affinity, note that the stateful NAT
engine requires conntrack.
<span class="quote">> > I don't have access to your ruleset, I would need a sketch ruleset of you to
> > understand better what you are trying to do and make better suggestions.
> >
> > Thanks.
>
> You can refer to the snippet of ruleset highlighted in k8s's pull request
> for more details.
>
> <a href="https://github.com/kubernetes/kubernetes/pull/123168#issuecomment-1931674294">https://github.com/kubernetes/kubernetes/pull/123168#issuecomment-1931674294</a>
>
> Note that: I use the trick "ip daddr set ip saddr map
> @affinityMapToEP-DBUHUTQG-default/alpine-service/tcp/iperf" instead of meta
> mark in this example. That works fine for this use-case, but it is not a
> recommended solution from the community.</span >
I have attached a sketch ruleset I build from your link, I mangled it to use ct
mark.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>