Page MenuHomeVyOS Platform

Policy local-route ability with uid or gid
Open, WishlistPublicFEATURE REQUEST

Description

nft add rule ip mangle output skuid 1001 counter mark set 1

Seems currently policy local route only use ip rule but without nftables rules , that is a little different from policy route implementation .

set policy local-route rule 1 uid 1000
set policy local-route rule 1 gid 1000
set policy local-route rule 1 set table 100

thanks !

Details

Difficulty level
Unknown (require assessment)
Version
-
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Unspecified (please specify)

Event Timeline

It supports uidrange https://man7.org/linux/man-pages/man8/ip-rule.8.html
is it what you want?

uidrange NUMBER-NUMBER
       select the uid value to match.

I don't see gid option there.

May be required also for correct working

sudo ip rule add prio 1000 from 192.0.2.1 uidrange 1001-1001 lookup 100

sudo sysctl -w net.ipv4.conf.all.rp_filter=2
sudo sysctl -w net.ipv4.conf.default.rp_filter=2

An additional you can already use it, as you mark it as 1

set policy local-route rule 100 fwmark 1
set policy local-route rule 100 set table 100

I think it depends on nftables , https://wiki.nftables.org/wiki-nftables/index.php/Matching_packet_metainformation#Matching_by_socket_UID_.2F_GID , it is first handled by nftables and mark , then use rule .

@freebsdjlu Policy local-route doesn't use nftables commands; it uses only ip rule

Viacheslav triaged this task as Wishlist priority.Jan 20 2024, 1:32 PM