Multiple conntrack tables

Multiple conntrack tables

[Sam Liddicott]

I know that a rule in raw can prevent a packet from being processed by
contrack..

I wonder if it could also identify which contrack table it should go in.

This problem first came up when using contrack for some extra iptables
rules with multiple bridges but where different bridges had clients
with the same IP address.

I used to think Mac addresses would need to be part of the contrack
key and did some trial work on that but now I realise that multiple
named or numbered conntrack tables would be better.

I don't need this feature now but it does seem like a good idea.

Sam

Re: Multiple conntrack tables

[Florian Westphal]

Sam Liddicott <sam@liddicott.com> wrote:
> I know that a rule in raw can prevent a packet from being processed by
> contrack..
> 
> I wonder if it could also identify which contrack table it should go in.

This is possible via conntrack zones, see
iptables-extensions(8), '--zone' option of CT target.

Re: Multiple conntrack tables

[Sam Liddicott]

Thanks, Florian, that's great!

Sam

On Wed, Jun 18, 2014 at 10:30 PM, Florian Westphal <fw@strlen.de> wrote:
> Sam Liddicott <sam@liddicott.com> wrote:
>> I know that a rule in raw can prevent a packet from being processed by
>> contrack..
>>
>> I wonder if it could also identify which contrack table it should go in.
>
> This is possible via conntrack zones, see
> iptables-extensions(8), '--zone' option of CT target.