After the patch submitted for T6191 in this commit , unexpected behavior was found when parsing policy routes which uses set table command
An example with latest code:
vyos@latest# run show config comm | grep policy
set policy route FOO interface 'eth1'
set policy route FOO rule 10 destination address '192.0.2.0/24'
set policy route FOO rule 10 set table '100'
set policy route FOO rule 10 source address '198.51.100.0/24'
set policy route FOO rule 20 destination address '192.0.2.0/24'
set policy route FOO rule 20 set table '20'
[edit]
vyos@latest# sudo nft list chain ip vyos_mangle VYOS_PBR_UD_FOO
table ip vyos_mangle {
chain VYOS_PBR_UD_FOO {
ip daddr 192.0.2.0/24 ip saddr 198.51.100.0/24 counter packets 0 bytes 0 meta mark set 0x7fffff9b comment "ipv4-route-FOO-10"
ip daddr 192.0.2.0/24 counter packets 0 bytes 0 meta mark set 0x7fffffeb comment "ipv4-route-FOO-20"
}
}
[edit]
vyos@latest#So, in this case, traffic from host 198.51.100.X to 192.0.2.X will go through both entries, and it will end up using table 20 (second mark will over-write first mark).
In older versions, such as Equuleus, a terminate action accept is added if set table command is used
Same config on Equuleus:
vyos@Equuleus# run show config comm | grep policy
set policy route FOO rule 10 destination address '192.0.2.0/24'
set policy route FOO rule 10 set table '100'
set policy route FOO rule 10 source address '198.51.100.0/24'
set policy route FOO rule 20 destination address '192.0.2.0/24'
set policy route FOO rule 20 set table '20'
[edit]
vyos@Equuleus# sudo nft list table ip mangle | tail -20
chain VYATTA_FW_LOCALOUT_HOOK {
}
chain FOO {
ip saddr 198.51.100.0/24 ip daddr 192.0.2.0/24 counter packets 0 bytes 0 jump VYATTA_PBR_100 comment "FOO-10"
ip daddr 192.0.2.0/24 counter packets 0 bytes 0 jump VYATTA_PBR_20 comment "FOO-20"
counter packets 0 bytes 0 return comment "FOO-1000000 default-action accept"
}
chain VYATTA_PBR_100 {
counter packets 0 bytes 0 meta mark set 0x80000063
counter packets 0 bytes 0 accept
}
chain VYATTA_PBR_20 {
counter packets 0 bytes 0 meta mark set 0x80000013
counter packets 0 bytes 0 accept
}
}
[edit]
vyos@Equuleus#