Tom Hacohen <tom@xxxxxxxxx> wrote: > I'm sorry for repeating myself, however I'd like to stress out again, > that while your workaround fixes an inconsistency between iptables and > nftables, the scenario itself is caused by the buggy behaviour of > masquerade with "lo", and that needs to be fixed too. The workaround > above, and any fixes to that issue will only fix the dropping of the > packets, but the wrong rewrite will still be there. The 'wrong rewrite' also occurs with iptables. It doesn't cause connectivity issues because in iptables the nat table always registers the output hook. (I agree that nft masquerade should not cause these connectivity issues, but I think proper ruleset fix is to use meta iif to restrict masq to the correct interface(s)). -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
