Daniel Collins <daniel.collins@xxxxxxxxxxxxxx> wrote: > Hi > > We have encountered problems when attempting to bridge packets that we > just sent, then saw a second time as the receiving router forwarded > them to another router attached to a different bridge port. I have no idea what that means. -v please. > This only occurs when SNAT was used on the original connection, this > seems to prevent the original conntrack entry from being used for the > bridged packet, Uhh.. what? Not following, sorry :-/ > instead creating a new one for them, our router's If a new conntrack is created, then the skb did not (yet) have a conntrack entry or something has caused the conntrack to be destroyed/discarded. The latter typically happens with veth, or other virtualization/container use cases where skb_scrub_packet() is called. > router then sends the replies directly to us (as you'd expect), but > Linux only undoes the first layer of NAT and then discards the packet > since a local socket for it doesn't exist. again, no idea what that means. Please explain in more detail or provide some graph that describes what is connected where, how the routing happens and where bridge(s) are sitting. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
