Kristian Evensen <kristian.evensen@xxxxxxxxx> wrote: > After spending long time looking at the source code, I can't figure > out why this happens. Once the MASQUERADE/SNAT rule has been inserted, > to me everything looks the same. The MASQUERADE target zaps conntracks that it "owned" when the associated link goes down, see masq_device_event() in ipt_MASQUERADE.c Also, the nat core zaps conntracks when they are sent out on an interface other than the original interface. See nf_nat_oif_changed() in iptable_nat.c -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
