diff options
| author | doctorpangloss <2229300+doctorpangloss@users.noreply.github.com> | 2026-04-11 18:24:13 -0700 |
|---|---|---|
| committer | doctorpangloss <2229300+doctorpangloss@users.noreply.github.com> | 2026-05-12 10:57:08 -0700 |
| commit | 2df14cbbc0e4e5e6657bb02938768d48f7294684 (patch) | |
| tree | 114c9553c747fe3b228f9407f7eaa894333b17d9 | |
| parent | 1dd997d724449e941c6bf42be98529372d9f1530 (diff) | |
| download | vyos-1x-2df14cbbc0e4e5e6657bb02938768d48f7294684.tar.gz vyos-1x-2df14cbbc0e4e5e6657bb02938768d48f7294684.zip | |
wan: T8480: add suppress_prefixlength ip rules for internal routing
WLB per-interface routing tables only contain a default route. When
LAN traffic is fwmarked by WLB nftables rules, ip rule policy routes
it to these tables where internal destinations (BGP, connected, DNAT)
have no matching route and incorrectly exit via WAN.
Add ip rule with table main suppress_prefixlength 0 before each
per-interface table rule. This checks the main routing table first
for specific routes but suppresses the default route, so only
internet-bound traffic falls through to WLB per-interface tables.
Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com>
| -rwxr-xr-x | src/helpers/vyos-load-balancer.py | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/src/helpers/vyos-load-balancer.py b/src/helpers/vyos-load-balancer.py index 4417c04d5..8cb792a5d 100755 --- a/src/helpers/vyos-load-balancer.py +++ b/src/helpers/vyos-load-balancer.py @@ -204,8 +204,11 @@ def cleanup(lb): index = 1 for ifname, health_conf in lb['interface_health'].items(): table_num = lb['mark_offset'] + index + suppress_prio = lb['mark_offset'] + index + table_prio = suppress_prio + 100 run(f'ip route del table {table_num} default') - run(f'ip rule del fwmark {hex(table_num)} table {table_num}') + run(f'ip rule del priority {suppress_prio}') + run(f'ip rule del priority {table_prio}') index += 1 run(f'nft delete table ip vyos_wanloadbalance') @@ -263,7 +266,10 @@ if __name__ == '__main__': else: run(f'ip route replace table {table_num} default dev {ifname} via {health_conf["nexthop"]}') - run(f'ip rule add fwmark {hex(table_num)} table {table_num}') + suppress_prio = lb['mark_offset'] + index + table_prio = suppress_prio + 100 + run(f'ip rule add fwmark {hex(table_num)} table main suppress_prefixlength 0 priority {suppress_prio}') + run(f'ip rule add fwmark {hex(table_num)} table {table_num} priority {table_prio}') index += 1 |