Re: nftables: masquerade sets wrong source address

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Tom Hacohen <tom@xxxxxxxxx> wrote:
> I'm sorry for repeating myself, however I'd like to stress out again,
> that while your workaround fixes an inconsistency between iptables and
> nftables, the scenario itself is caused by the buggy behaviour of
> masquerade with "lo", and that needs to be fixed too. The workaround
> above, and any fixes to that issue will only fix the dropping of the
> packets, but the wrong rewrite will still be there.

The 'wrong rewrite' also occurs with iptables.

It doesn't cause connectivity issues because in iptables the nat table
always registers the output hook.

(I agree that nft masquerade should not cause these connectivity issues,
 but I think proper ruleset fix is to use meta iif to restrict masq to
 the correct interface(s)).
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux