Hi Tom, On Thu, Dec 15, 2016 at 11:34:57AM +0000, Tom Hacohen wrote: > Hey, > > Thanks for your reply. > > I'm sorry, but I don't have access to older kernels. Furthermore, > this worked with iptables on the same kernel version using the same > rules as far as I can tell. Hm, this is working with the same kernel version in iptables? What kernel version are you using? > I therefore suspect (without knowing the code) that maybe nftables is trying > to masquerade all packets while iptables maybe has a noop when there was no > NAT applied, or if the address is already set correctly? That is the best > explanation that comes to mind given your assertion about them sharing the > masquerade code. Both nft and iptables share the same codebase for NAT/masquerade, so if this works with iptables, it shoud work with nft too in the same way. Please, confirm this, it would be good if we get to the core of the problem. If the behaviour differs, or started to differ from some kernel version on, then this is a bug. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
