On Tue, Dec 13, 2016 at 01:28:41PM +0000, Tom Hacohen wrote: > Removing the masquerade line, or changing it to: "oifname wlp1s0 > masquerade" fixes it, but this is just a workaround that will fail > in more complex situations. ISTM you'd always want to limit a MASQ/SNAT rule by outgoing interface. I don't get why that was "ugly" (as you said in IRC) or likely to fail ... well, certainly if using that ruleset where the default gateway was on some other interface, but so what? Adjust your rule to suit the situation. In more complex situations, such as multiple Internet connections with policy routing, masquerade is not appropriate. You'd have to use SNAT. If you're doing NAT among RFC 1918 networks, YDIW. Fix the routing. -- http://rob0.nodns4.us/ Offlist GMX mail is seen only if "/dev/rob0" is in the Subject: -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
