0

(This is a simplified version of this: Can Linux do "source MAC based routing?")

I have an appliance that needs to route egress packets back to the MAC interface where the ingress packets were received. This is considered "source-MAC based routing" or "return-to-sender" since only the source MAC address will be used to determine where to send the packets. The Layer 3 IP addresses and Layer 4 ports will not be able to identify the correct next hop.

The network flow will look like this:

  client1
     | NET-A
     v 1.  
+---------+   2.  +---------+ 
|         | ----> |         |
| router1 | NET-B |  myapp  | 
|         | <---- |         |
+---------+   3.  +---------+
     | NET-C
     v 4. 
  server1

There will be several instances of the router (router1, router2, router3, etc), and myapp (which is a transparent proxy meaning it does not alter the L3/L4 components) needs to choose the correct router instance to return the packets to. myapp can't do normal destination-based routing since the L3 destination will not identify which router sent it the traffic in the first place.

I'm hopeful that nftables will be able to do this, but I have very little experience with nftables (much more with iptables, but so far it seems inadequate). Here is my pseudo logic for myapp with eth0 connected to NET-B

Packet inbound on eth0

  1. Is packet part of a previously seen flow?

NO: Map this L3/L4 flow to the source MAC and continue to step 2

YES: Continue to step 2

  1. Process packet and send packet out

Packet outbound on eth0

  1. Look up flow in table to find the target MAC

  2. Forward packet to the target MAC

Is this something nftables can do? Any pointers on getting started are appreciated.

Rusty Lemur
  • 843
  • 1
  • 7
  • 14
  • Probably not. I doubt that you can create a "relation" between `2` and `3`. It might be possible if `2` and `3` are like the two "parts" of *IP forwarding*, but apparently in your case they are "standalone" traffics that are received by / redirected to and originated from a proxy program respectively. – Tom Yan Apr 05 '22 at 05:13
  • Is server1 reached only from clients behind router1? this allows to bind 2 with 3: a client behind raX can only intend to reach a server behind same raX and such choice is selected. Note that this is not part of your link https://www.kareemccie.com/2019/12/what-is-source-mac-address-based-routing.html : the step 3 is not return traffic here. – A.B Apr 06 '22 at 14:57
  • So any return to my comment? Is it guaranteed that a client reaches a server that uses the same router as the client each time? – A.B Apr 10 '22 at 21:15
  • Yes, it is guaranteed that for one client only one router will handle the entire flow – Rusty Lemur Apr 11 '22 at 23:24

0 Answers0