MAP-T also benefits from map.sh.new

[angus19]

Thanks fakemanhk.
Those nftables commands presented in map.sh.new are also good for a MAP-T line.
I got one more question in below, a typical MAP-T/E, iptbales command about the use of "--connlimit-daddr".

iptables -t nat -A POSTROUTING -p tcp -m connlimit --connlimit-daddr --connlimit-upto 1024 -o mapmint -j SNAT --to 172.17.2.243:15360-16383

How should we do for nftables to achieve "--connlimit-daddr"?
Did some research but still got no improvement.
Would be appreciated if somebody has comment.

[fakemanhk]

I think there is no direct replacement for connection limit option, however I found someone doing this with a few more lines of nftables:

https://serverfault.com/questions/934092/how-do-you-set-a-max-connection-limit-with-nftables

[angus19]

Hello fakemanhk,
Below comes a fine-tuned version of map.sh.new.
Partial of it was changed and then displayed.
We don't need numgen and allports anymore.
Instead, we count on the meter + ct count expression.
`
#------------------------------------
#MODIFICATION 1: Create mape table
#------------------------------------
if nft list tables | grep -q "table inet mape"; then
nft delete table inet mape
fi
nft add table inet mape
nft add chain inet mape srcnat {type nat hook postrouting priority 0; policy accept; }
#------------------------------------
#END MODIFICATION 1
#------------------------------------

#------------------------------------
#MODIFICATION 2: Get all ports, and full port count.
# Don't include ports in DONT_SNAT_TO
#------------------------------------
local slice=0
for portset in $(eval "echo $RULE_${k}_PORTSETS"); do
local portcount=0
local startport=$(echo $portset | cut -d'-' -f1)
local endport=$(echo $portset | cut -d'-' -f2)
for x in $(seq $startport $endport); do
if ! echo "$DONT_SNAT_TO" | tr ' ' '\n' | grep -qw $x; then
portcount=expr $portcount + 1
fi
done
#------------------------------------
#END MODIFICATION 2
#------------------------------------

#------------------------------------
#MODIFICATION 3: Create the rules to snat to all the ports
#------------------------------------
local counter=0

        for proto in icmp tcp udp; do
            slice=`expr $slice + 1`
            nft add rule inet mape srcnat meta l4proto $proto oifname "map-$cfg" meter connlimit$slice { ip daddr ct count $portcount } snat ip to $(eval "echo \$RULE_${k}_IPV4ADDR"):$portset
        done
    #END MODIFICATION 3
    done

`

[fakemanhk]

The discussion in your PR was showing some issues, are you able to take a look on that.

[angus19]

Please abandon that PR as I got no more better solutions for now. Thanks.

[fakemanhk]

BTW coming back to this discussion, which provider you are using which has MAP-T?

[angus19]

None of providers are used and MAP-T can still be tested with the setup described in the following document.
https://community.cablelabs.com/wiki/plugins/servlet/cablelabs/alfresco/download?id=9280e9b7-773e-4e11-ae84-68b09e32baf0
Please check the detail of MAP Virtual Network Environment.