On 20.01.2017 10:47, Mark Coetser wrote: > Hi Llorente > > I did run conntrack -F to check that but still had the unnatted packets > traversing the interface. > Hi, I'm seeing this as well on our systems. One thing I notice is that all packets either the RST of FIN flag set. Could this be some sort of race condition where Conntrack removes the connection from the table because of the flags and as a result the final packet will not get masqueraded/nat'ed? Regards, Dennis -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
