ROS 7 - Routing Rules - Address list - and NOT option would be nice!

In ROS7 routing Rules…
it would be handy in source and destination to be able to add an address list.
Also to be able to add the NOT option.
Don’t you think?
Would it be possible?

No, that would not be possible. At least not without modification of the Linux kernel (it does not support address lists in routing rules, and no NOT option either).

Yes would love an address list function in routing rules
or a better keep alive schema for WG when the server IP disappears but
only after…
an options package for zero trust cloudflare tunnel !!!

Well, it might be a question of interpretation but IMO it’s not a limitation in the kernel itself but rather in the RoS rule engine. There are close to no limitations at all when using Netfilter/[e]BPF with iptables/nftables, it’s just a matter of how the rule engine interpret and applies things to the network stack.



Yes, but of course! LOL :smiley:

“routing rules” are not processed using iptables/nftables but they are a separate feature accessible in Linux via “ip rule”. It does not support address lists or the NOT operator.
Of course you could work around that using route marking mangle rules, but that is already possible in RouterOS. It has limitations, e.g. w.r.t. using “fasttrack”.

But the idea with /routing/rules is that they are a direct map in the kernel, and operate without needing conntrack (outside of resulting NAT).

Not saying there shouldn’t be a UI to make this easier, but not sure the routing rules is the best place. It’s actually handy that these are are pretty direct map to the Linux kernel, which is going to be more important as more chipset support L3 offloading.

I posted this another thread, but if you group the IP together within the same prefix range, say a /27 or /28 or whatever… you can use that prefix in the routing rules to select that group for different routing treatment.

You are correct and it was sloppily expressed on my part. The point I was trying to make is that there are actually no direct limitations in the kernel even though the routing management itself is not available using the XYtables interfaces.