Policy Based Routing (pbr) and arbitrary docker container

Installing and Using OpenWrt
1

Thank you to all those contributing to PBR for such a great addition to OpenWRT.

I'm looking for a bit of guidance. Background is I have a classic docker stack behind a traefik proxy. What I'd like to do is route any given container via pbr logic when it needs external endpoints (VPN vs ISP). The only way I've managed to roll this out is to give the container a static IP on the host network with macvlan. It seems a bit hacky to me as well as it will not scale.

I've tried to give the PBR rules using static IPs within the docker stack as well as a static mac address and/or hostname, but it seems all the layers before the traffic hits OpenWRT/PBR strip away what is needed.

I'd welcome any suggestions on what I may also try to remove the requirement of static IP assignments.

Many thanks!

3

Answering my own query here...basically you can piggyback in this manner:
https://scribe.froth.zone/@sruffilli/abusing-the-ip-dscp-flag-for-fun-and-no-profit-368174621311

1 Like
4

Just to confirm, you ended up using DSCP tagging?

5

I haven't yet, but this seems clear cut. Basically sidecar a container and adjust iptables then route through that container.

HTH

6

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.