<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - nftables - dynamic update for verdict map from the packet path"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1736#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - nftables - dynamic update for verdict map from the packet path"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1736">bug 1736</a>
from <span class="vcard"><a class="email" href="mailto:dinhtrason@gmail.com" title="dinhtrason@gmail.com">dinhtrason@gmail.com</a>
</span></b>
<pre><span class="quote">> Are you fully using the 32 bits in the mark _only_ for masquerading?</span >
No, masquerading takes one bit of the packet mark. The location of the bit
however is not fixed (i.e. it is a configuration option), making the usage of
meta mark is even more difficult.
You can refer to masqueradeBit in the link for more details.
<a href="https://kubernetes.io/docs/reference/config-api/kube-proxy-config.v1alpha1/#kubeproxy-config-k8s-io-v1alpha1-KubeProxyNFTablesConfiguration">https://kubernetes.io/docs/reference/config-api/kube-proxy-config.v1alpha1/#kubeproxy-config-k8s-io-v1alpha1-KubeProxyNFTablesConfiguration</a>
<span class="quote">>
> If you use conntrack, then can you use connlabel?
> </span >
No, conntrack is not used in the context of this chain.
<span class="quote">>
> I don't have access to your ruleset, I would need a sketch ruleset of you to
> understand better what you are trying to do and make better suggestions.
>
> Thanks.</span >
You can refer to the snippet of ruleset highlighted in k8s's pull request for
more details.
<a href="https://github.com/kubernetes/kubernetes/pull/123168#issuecomment-1931674294">https://github.com/kubernetes/kubernetes/pull/123168#issuecomment-1931674294</a>
Note that: I use the trick "ip daddr set ip saddr map
@affinityMapToEP-DBUHUTQG-default/alpine-service/tcp/iperf" instead of meta
mark in this example. That works fine for this use-case, but it is not a
recommended solution from the community.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>