On Wed, Dec 05, 2018 at 12:59:43AM +0200, Pavel Melnik wrote: > Hi > > > I'd just change NF_IP6_PRI_RAW to -450 and use ip6tables rules in raw > > table. > > We will try, thanks Have a look at: commit 902d6a4c2a4f411582689e53fb101895ffe99028 Author: Subash Abhinov Kasiviswanathan <subashab@xxxxxxxxxxxxxx> Date: Wed Jan 10 20:51:57 2018 -0700 netfilter: nf_defrag: Skip defrag if NOTRACK is set It's providing a way to do this in the way Florian has mentioned.