Lorenzo Colitti [off-list ref] wrote:

On Mon, Nov 30, 2015 at 11:08 AM, Florian Westphal [off-list ref] wrote:

quoted

We have ctnetlink which allows direct setting of ctmark/ctlabels.

Can those labels be set early enough in the stack to affect the source
address chosen for outgoing connections?

No, same restrictions as connmarks or skb marks apply.

Furthermore, since its stored in the conntrack area, the conntrack isn't
created until after the first packet hits NF output hook, and its not
visible until after POSTROUTING hook.

There was an out of tree patch to allow to use ipsets to select
source addresses instead of mark+fwmark:

https://lkml.org/lkml/2012/12/3/93

I think thats something we shouldn't really go for this.

However, if fwmark is too limiting (and given these hacks exist),
maybe we should start thinking for alternatives?