Hi, Thanks for your quick and detailed reply! On Wed, May 2, 2018 at 12:24 AM, Florian Westphal <fw@xxxxxxxxx> wrote: > I'm not sure what the best way to solve this is, we either need > to insert earlier in nfqueue case, or do conflict resolution in nfqueue > case (and perhaps also nat undo? not sure). My knowledge of the conntrack/nat subsystem is not that great, and I don't know the implications of what I am about to suggest. However, considering that the two packets represent the same flow, wouldn't it be possible to apply the existing nat-mapping to the second packet, and then let the second packet pass? BR, Kristian -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
