Re: Policy routing idea (Was: ipfw: Would it be possible tocontinue processing rest of rules after match ?)

From: Andre Oppermann (andre_at_freebsd.org)
Date: 06/22/05

  • Next message: Ryan Rathje : "Transparent Squid 2.5Stable10 + FreeBSD 5.4" 
    Date: Wed, 22 Jun 2005 14:53:46 +0200
To: Luigi Rizzo <rizzo@icir.org>

    Luigi Rizzo wrote:
    >
    > On Tue, Jun 21, 2005 at 09:27:30AM +0300, Ari Suutari wrote:
    > > Hi,
    > >
    > > I sent this to ipfw mailing list some time ago, but
    > > got no response. I would like to adjust ipfw behaviour
    > > with fwd rules to make policy routing easier (ie. make
    > > it separete from filtering rules). I would just like
    > > some input if this makes any sense (or is possible at
    > > all with current design).
    >
    > i suggest to implement a new action 'setnexthop' which stores the
    > next hop as an MTAG with the packet (so it is preserved if the
    > packet gets passed to dummynet).

    Please don't store routing table pointers. All the locking due
    to pointers to route entries in random places makes SMP a pain
    a slows down routing table lookups.

    > But perhaps, rather than a specific next hop, maybe you want to
    > pass a reference to a different routing table instead ?

    We don't have any at the moment. 

    -- 
Andre
>         cheers
>         luigi
> 
> >  >Currently the ipfw fwd rules work so that the packet
> >  >is accepted when fwd rule matches.
> >  >
> >  >Would it be possible just tag the packet with
> >  >information about next_hop and just continue processing the
> >  >rules ? This would make complex rulesets with policy-based
> >  >routing much simpler, since one could just have relevat
> >  >fwd statments at beginning of rule sets and then
> >  >filter the packets in usual way.
> >
> >       Ari S.
> > _______________________________________________
> > freebsd-net@freebsd.org mailing list
> > http://lists.freebsd.org/mailman/listinfo/freebsd-net
> > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
> _______________________________________________
> freebsd-net@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
  • Next message: Ryan Rathje : "Transparent Squid 2.5Stable10 + FreeBSD 5.4"

    Relevant Pages

    • Re: Failover and load balancing using advanced NAT daemon
      ... > You may want to check out PF, the packet filter imported from OpenBSD. ... > I have it running on some large routers doing NAT out multiple ... load balancing and policy routing. ... I have always used ipfw ...
      (freebsd-net)
    • Re: How do I read/interpret a (netstat) routing table ?
      ... I know this routing table is used to direct TCP/IP packets to their destination. ... Assume on local computer 192.168.0.14 a TCP-IP packet is arriving with the destination ... NetMask --> Makes it easier for the Router (layer 3 device, ...
      (microsoft.public.windowsxp.network_web)
    • Re: [was] addition to ipfw (read vlans from bridge)..
      ... into the packet as well as the packet, then yes I like that idea, ... At the moment I plan the ipfw code to be unaware of vlan headers. ... What we need to do is make a convention so that vlan tags are always ...
      (freebsd-net)
    • Re: Programming Question: Policy Based Routing
      ... My definition of Policy-Based Routing: ... address, L4 protocol, tos, packet length. ... packet and an AVL tree to store routing information in it. ... first thing is to create a generic route mask. ...
      (freebsd-net)
    • Re: Programming Question: Policy Based Routing
      ... > My definition of Policy-Based Routing: ... > address, L4 protocol, tos, packet length. ... > packet and an AVL tree to store routing information in it. ... > first thing is to create a generic route mask. ...
      (freebsd-net)