Summary

Testing load-balancing wan on rolling with real traffic, using a LAN and two ISPs in network namespaces, uncovered several bugs. The existing smoketest misses all of them, because it never sends a packet.

Some configurations pass commit but break the health daemon afterwards. A ping or ttl health test without a target, or protocol !all on a rule, makes the daemon fail until systemd gives up, which leaves WAN load-balancing inactive without any error shown. A rule interface without interface-health is silently left out of the rule.

Several options do not work at all. Interface names containing a dash are never used, inbound-interface any matches no packet, and per-packet-balancing and limit threshold above have no effect. The ttl health test is inverted, so a dead uplink stays ACTIVE, and the start-up hook only reports the first interface.

Bugs

1. A ping/ttl health test without target, and rule N protocol !all, pass commit. The health daemon then crashes or fails to load its rules and hits the systemd start limit. WAN load-balancing stops without any error shown.
2. A rule interface without interface-health is silently left out of the rule.
3. The daemon mangles - in interface names to _, so such interfaces are never used.
4. inbound-interface any renders as iifname "any" and matches nothing.
5. per-packet-balancing and limit threshold above have no effect.
6. The ttl health test is inverted: a dead uplink stays ACTIVE, and a reachable target marks the interface FAILED.
7. The start-up hook reports only the first interface.
8. Marks and routing tables follow the sorted interface list. Adding an interface renumbers the others and breaks their existing connections.
9. Every commit restarts the daemon. Rules, routes and health state are gone until it is back, and new connections are neither balanced nor source-NATed in the meantime.