<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:neuroarmitage@proton.me" title="Simon G. Trajkovski <neuroarmitage@proton.me>"> <span class="fn">Simon G. Trajkovski</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - nftables - dynamic update for verdict map from the packet path"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1736">bug 1736</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>neuroarmitage@proton.me
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - nftables - dynamic update for verdict map from the packet path"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1736#c10">Comment # 10</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - nftables - dynamic update for verdict map from the packet path"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1736">bug 1736</a>
from <span class="vcard"><a class="email" href="mailto:neuroarmitage@proton.me" title="Simon G. Trajkovski <neuroarmitage@proton.me>"> <span class="fn">Simon G. Trajkovski</span></a>
</span></b>
<pre>Thanks for simplifying the ruleset.
Looking at your previous ruleset snippet, it looks like the goal is to find the
endpoint for DNAT?
If so, then something like this should be fine?
table ip loadbalancer {
map affinity-mappings {
type ipv4_addr : ipv4_addr
size 65535
flags dynamic,timeout
timeout 4m
elements = { 192.168.0.156 timeout 4m expires 3m59s996ms :
11.0.2.2, 192.168.0.211 timeout 4m expires 3m56s64ms : 11.0.2.1,
192.168.10.254 timeout 4m expires 3m53s974ms :
11.0.2.2 }
}
map epToChain {
type ipv4_addr : verdict
elements = { 11.0.2.1 : goto endpoint-1, 11.0.2.2 : goto
endpoint-2 }
}
chain endpoint-1 {
counter packets 2 bytes 224
update @affinity-mappings { ip saddr : 11.0.2.1 }
meta l4proto tcp dnat to 11.0.2.1 : 5001
}
chain endpoint-2 {
counter packets 203 bytes 11940
update @affinity-mappings { ip saddr : 11.0.2.2 }
meta l4proto tcp dnat to 11.0.2.2 : 5001
}
chain service-ABC {
meta l4proto tcp dnat to ip saddr map @affinity-mappings : 5001
numgen random mod 2 vmap { 0 : goto endpoint-1, 1 : goto
endpoint-2 }
}
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
goto service-ABC
}
}
note that the relevant part is:
meta l4proto tcp dnat to ip saddr map @affinity-mappings : 5001
numgen random mod 2 vmap { 0 : goto endpoint-1, 1 : goto
endpoint-2 }
look up for an existing affinity mapping, it exists, use it for dnat.
Otherwise, update the affinity map and set dnat.
You can combine dnat with map lookups, it is also possible to use
concatenations, such as 11.0.2.1 . 5001 in the affinity map.
(I am all the time assuming port 5001 is the destination port, as in your
previous snippet).</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>