Basically trying to bend bridging and NATing to my will with quite a unique project.
I've simplified what I'm doing below (VM=Kali virtual machine for testing):
ZoneX's are network namespaces, vexxx's are virtual links created with ip link
The premise is to create a gateway for the LAN which can divert traffic (based on what it is) to either ZoneX or ZoneY modify the traffic and forward it to ZoneZ and finally out to the real networks gateway.
I've tried quite a few different things, however the main problem is either from creating a layer2 storm... not nice in VM's... or the NAT net namespace (ZoneZ) forwards the return traffic via the first interface in the NAT table for the client VM (which is sometimes incorrect).
The main aim is to split the traffic to multiple zones but have the return traffic take the same route back, thats the clincher! The next stage is then to be able to chain multiple Zones together to modify the traffic in multiple ways.
A connection example would be a DNS lookup to 188.8.131.52 and an TCP request to 184.108.40.206, both from the VM.
Firstly the DNS request passes to eth0 over brA to ve001, to ZoneA where the packet is marked (using iptables) and passed to ve003 > ve004 etc. to ve006 where it is NAT'd and sent out to the internet. When the response returns to ZoneZ (the NAT zone) the lookup in the NAT table is done and the packet is routed to ve006 because the ARP entry for the VM machine points to that interface. The main trouble comes when I have other traffic I want to forward via the bottom route. Same as before until ZoneA, however this time it is routed down to ve007, through ZoneY and finally into ZoneZ, its then passed over the NAT gw and onto the internet. However, when a reply is received for this connection the packets go to ZoneZ the lookup is done in the NAT table, its translated and then the ARP table lookup is done, this is when it forwards it back via ve006 which is wrong, I want it to go back the way it came (in this case via ve010).
I guess my question should be, can I get the NAT table to record the interface it was presented from and forward it back via that?