Hi All,
Have anyone tried the following setup on a single machine with 2 TCP
sockets on different VRF's and succeeded?
- client_socket on VRF1
- server_socket on VRF2
- ip rules and iproutes for inter-VRF set up
- client_socket sends TCP connect to server_socket. skb was sent using
VRF1 interface
- skb received in loopback interface
- TCP code got SYN but cannot route back to VRF1 to send ACK.
I was wondering if this is a known limitation of VRF as of the moment,
or could work with proper iprules/iproute.
Thanks!
Darwin
On 4/12/16 4:09 AM, Darwin Dingel wrote:
Hi All,
Have anyone tried the following setup on a single machine with 2 TCP
sockets on different VRF's and succeeded?
- client_socket on VRF1
- server_socket on VRF2
- ip rules and iproutes for inter-VRF set up
- client_socket sends TCP connect to server_socket. skb was sent using
VRF1 interface
- skb received in loopback interface
That is the key problem there.
- TCP code got SYN but cannot route back to VRF1 to send ACK.
I was wondering if this is a known limitation of VRF as of the moment,
or could work with proper iprules/iproute.
In general local (within a single system) routing does not work with top
of tree. e.g., within a VRF you can not connect sockets or ping a VRF
local address. Inter-vrf connections within a system also do not work.
I have patches from our 4.1 kernel that I have rebased to top of tree. I
hope to test and send those out in the next week or so. It addresses the
first problem -- connections within a VRF. While it does not resolve
your problem of connecting across VRFs within a system I think it is the
foundation for how to fix it.