ip rule with tens of thousands rules in openwrt - linux

Question

I am setting my openwrt (Netgear R3800) to support policy routing with multiple outbound interfaces by the following shell scripts. I put ip lists for different outgoing interfaces in text file and use ip rule to set different ip tables.
e.g.
ip route add default via $VPN1 dev $VPNDEV1 table 100
ip route add default via $VPN2 dev $VPNDEV2 table 200
for IPTO in `cat /root/routes/policy_ips1` ; do
ip rule add to $IPTO table 100
done
for IPTO in `cat /root/routes/policy_ips2` ; do
ip rule add to $IPTO table 200
done
The script does work most time but sometimes not stable.
As the ip lists (file policy_ips1, policy_ips2) are considerable large. like 10-20 thousands lines, each line is a subnet like '1.0.1.0/24'. I am wondering whether this is an effective way as there will be tens of thousands rules and the router will query the routing policy databas RPDB for every packet.
A further question is that as the Priority of RPDB ranges from 0 to 32767 (ref:http://man7.org/linux/man-pages/man8/ip-rule.8.html), does it mean I cannot add more than 32765 rules? Is there any capability limit in using ip rule? And is there any limit with respect to the computational capability of the router(like router's cpu, ram)?

Answer 1

[I'm not exactly sure this question is appropriate for SO, but]
For this kind of setup I would use Netfilter (with ipsets) to mark packets and use fwmark-based rules to match packets in the RPDB. Like
ipset create nets100 hash:net
ipset create nets200 hash:net
for IPTO in `cat /root/routes/policy_ips1` ; do
ipset add nets100 "$IPTO"
done
for IPTO in `cat /root/routes/policy_ips2` ; do
ipset add nets200 "$IPTO"
done
iptables -A PREROUTING -t mangle -m set --match-set nets100 src -j MARK --set-mark 100
iptables -A PREROUTING -t mangle -m set --match-set nets200 src -j MARK --set-mark 200
ip route add default via $VPN1 dev $VPNDEV1 table 100
ip route add default via $VPN2 dev $VPNDEV2 table 200
ip rule add fwmark 100 table 100
ip rule add fwmark 200 table 200
IPsets can easily handle lots of addresses/networks and you have a simple RPDB as a result. Although it should be noted that this adds some Netfilter overhead to packet processing, but choosing between big RPDB and ipsets I would for ipsets.
As for priority, I would read it as "no more than 32767 rules".