This is easier to do via source IP policy-based routing if you have a static IP, but this way you don't need to hardcode the IP anywhere, for dynamic cases. If you have multiple such interfaces then maybe connmark stuff on the way in.
-
-
Show this thread
-
Note: the routing table your fwmark gets pointed at needs to have the default route to the relevant interface (no need for static IPs if it's p2p like PPPoE, since that's interface only), and also your local subnet to its interface, else the 3rd packet onwards will hairpin.
Show this thread -
Update: though the above does work for general Linux routers, it disables hwnat acceleration on the EdgeRouter-X. This doesn't: iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark iptables -t mangle -A PREROUTING -i pppoe0 -m state --state new -j CONNMARK --set-mark 10
Show this thread -
Incidentally, even though the Ralink hw_nat module is open source (the Cavium equivalent isn't...), I haven't been able to find where in the code it determines what firewall rules disable the fastpath. Still looking...
Show this thread
End of conversation
New conversation -
-
-
Do you have an nftables variant of that? Looks very useful, but don’t use iptables anymore :/
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.