Skip to content

port/builtin: switch away from iptables to nft #589

Description

@AkihiroSuda

func (d *childDriver) setupTransparentRouting() bool {
// Check that iptables is available before proceeding.
if _, err := exec.LookPath("iptables"); err != nil {
fmt.Fprintf(d.logWriter, "source IP transparent: iptables not found, disabling: %v\n", err)
return false
}
// Verify the connmark module is usable (kernel module might not be loaded).
if out, err := exec.Command("iptables", "-t", "mangle", "-L", "-n").CombinedOutput(); err != nil {
fmt.Fprintf(d.logWriter, "source IP transparent: iptables mangle table not available, disabling: %v: %s\n", err, out)
return false
}
cmds := [][]string{
// Table 100: treat all addresses as local (for delivery to transparent sockets)
{"ip", "route", "add", "local", "default", "dev", "lo", "table", "100"},
{"ip", "-6", "route", "add", "local", "default", "dev", "lo", "table", "100"},
// Route fwmark-100 packets via table 100
{"ip", "rule", "add", "fwmark", "100", "lookup", "100", "priority", "100"},
{"ip", "-6", "rule", "add", "fwmark", "100", "lookup", "100", "priority", "100"},
// Inherit fwmark from SYN to accepted socket (needed for userspace proxies
// like docker-proxy, so that SYN-ACK routing uses table 100)
{"sysctl", "-w", "net.ipv4.tcp_fwmark_accept=1"},
// In OUTPUT: tag transparent connections (non-local source) with CONNMARK
{"iptables", "-t", "mangle", "-A", "OUTPUT", "-p", "tcp", "-m", "addrtype", "!", "--src-type", "LOCAL", "-j", "CONNMARK", "--set-mark", "100"},
{"ip6tables", "-t", "mangle", "-A", "OUTPUT", "-p", "tcp", "-m", "addrtype", "!", "--src-type", "LOCAL", "-j", "CONNMARK", "--set-mark", "100"},
// In PREROUTING: restore connmark to fwmark for routing
{"iptables", "-t", "mangle", "-A", "PREROUTING", "-p", "tcp", "-m", "connmark", "--mark", "100", "-j", "MARK", "--set-mark", "100"},
{"ip6tables", "-t", "mangle", "-A", "PREROUTING", "-p", "tcp", "-m", "connmark", "--mark", "100", "-j", "MARK", "--set-mark", "100"},
}
for _, args := range cmds {
if out, err := exec.Command(args[0], args[1:]...).CombinedOutput(); err != nil {
fmt.Fprintf(d.logWriter, "source IP transparent routing setup: %v: %s\n", err, out)
}
}
return true
}

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions