Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > Conntrack needs to see traffic in both directions, otherwise it is > pickup the state from the middle from time to time (part of the > history is lost for us). > > What am I missing here? Connectivity breaks. First packet that conntrack picks up is the syn-ack, this results in following sequence: 1. SYN x:12345 -> y -> 443 // sent by initiator, receiverd by responder 2. SYNACK y:443 -> x:12345 // First packet seen by conntrack, as sent by responder 3. tuple_force_port_remap() gets called, sees: 'tcp from 443 to port 12345 NAT' -> pick a new source port, inititor receives 4. SYNACK y:$RANDOM -> x:12345 // connection is never established This needs: 1. conntrack + nat enabled 2. connection is forwarded between two different machines 3. SYN packet is sent by a different route so conntrack only sees return traffic. This broke before as well if you would e.g. add 'masquerade random' rule, but now the nat core does that automatically due to the 'port shadow avoidance' change.
