我真的羡慕自己，特别的极端崇拜，要是我拉二胡能像摆弄Linux网络那样随心所欲，我就敢请个一个月的无薪长假，去公园每天拉半天二胡...只可惜到现在还没怎么拉响。 一个多月前，我对Netfilter conntrack做了一个优化，即将conntrack分为了多个表替换现在的一个表，目的是为了提高查找的效率，这个优化是独立进行的，我希望在最新的内核版本中存在这样的优化，然而没有。但是却有一个类似的，即conntrack zone的支持，这个特性不是为了优化，它仅仅在conntrack中增加了一个键值，即zone，这样就可以将同样的conntrack或者NAT规则放在不同的zone中了。这个特性有什么用呢？在LWN上有一篇Artical上有讲到： The attached largish patch adds support for "conntrack zones", which are virtual conntrack tables that can be used to seperate connections from different zones, allowing to handle multiple connections with equal identities in conntrack and NAT.
A zone is simply a numerical identifier associated with a network device that is incorporated into the various hashes and used to distinguish entries in addition to the connection tuples. Additionally it is used to seperate conntrack defragmentation queues. An iptables target for the raw table could be used alternatively to the network device for assigning conntrack entries to zones.
This is mainly useful when connecting multiple private networks using the same addresses (which unfortunately happens occasionally) to pass the packets through a set of veth devices and SNAT each network to a unique address, after which they can pass through the "main" zone and be handled like regular non-clashing packets and/or have NAT applied a second time based f.i. on the outgoing interface.
Something like this, with multiple tunl and veth devices, each pair using a unique zone:
<tunl0 / zone 1> | PREROUTING | FORWARD | POSTROUTING: SNAT to unique network | <veth1 / zone 1> <veth0 / zone 0> | PREROUTING | FORWARD | POSTROUTING: SNAT to eth0 address | <eth0>
As probably everyone has noticed, this is quite similar to what you can do using network namespaces. The main reason for not using network namespaces is that its an all-or-nothing approach, you can‘t virtualize just connection tracking. Beside the difficulties in managing different namespaces from f.i. an IKE or PPP daemon running in the initial namespace, network namespaces have a quite large overhead, especially when used with a large conntrack table.
