Module router 

The router both kinds of target add when a spec has reach rules: a machine on every network at its last address, forwarding between networks and filtering with nftables. Machines route the networks they aren’t on through it.

A network can instead name a machine of the environment as its gateway (an edge firewall): the router stays off it, and its machines route through that gateway.

The facts (where the router stands, which networks it routes) are the plan’s (isoloom_plan::routing), re-exported here beside what is rendered from them, so a backend reads the router in one place.

Constants

NAME

The router machine’s name (a spec can’t use it: machine names are user names, and this one is prefixed).

Functions

address

The router’s address on a network.

default_gateway

Where a machine sends traffic for everywhere else (the internet included): the gateway of its first network routed by another machine.

forward_rules

The rules of the router’s forward chain: replies, then what each reach rule between two networks it routes opens.

is_gateway

Whether the machine is the gateway of one of its networks.

machine_tc_script

The same on a machine’s own interfaces (addr: its address on a network), so traffic between machines of one network (a direct cable, a LAN) is impaired too, not only what the router forwards into it: each end delays what it sends, delay is one-way.

needed

Whether the spec needs a router: reach rules between networks it routes itself.

networks

The networks the router is on.

nftables

The nftables ruleset: forwarding between networks is dropped, except what reach allows (and replies to it).

plain

Whether Isoloom routes this network with its own router: no machine is its gateway (a network the spec doesn’t declare has none).

routed

Whether traffic crosses networks at all (Isoloom’s router, or a machine as gateway).

routes

Routes a machine needs to the networks it isn’t on: a network with a gateway through that gateway (on a network they share), the others through the router (on the machine’s first network the router is on). Networks with neither route are left to the default route.

tc_script

Shell that applies each network’s tc on the router’s interface into it (found by the router’s address there), or None when no network asks for it. Idempotent (replace).