fxp2001640163@xxxxxxxxx <fxp2001640163@xxxxxxxxx> wrote: > From: Xiaoping Fan <xfan@xxxxxxxxxxxxxx> > > In some case, bridged packet will come back again for routing. When bridge > netfilter is enabled, a null snat rule is assigned to bridged packet if no > matching in nat chain. Then nat rule matching is skipped when packet comes > back for routing. This result in private IP address exported to public > network. So we don't assign a null snat rule to bridged traffic if no > matching. This looks bogus. However, we already have issue with existing iptables nat vs nftables nat. So I think it might make sense to delay NULL binding allocation until we confirm the conntrack so users don't have to rmmod iptable_nat anymore when they use nftables as well. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
