Subject: Re: masquerading AFTER first packet

From: Florian Westphal <[email-masked]>
Date: Thu, 2 Sep 2021 22:07:36 +0200

folkert <[email-masked]> wrote:
> > You might want to try and disable udp releated offload settings to see
> > if that helps.
> 
> If offloading is the problem, wouldn't the first packet fail as well?

No, not necessarily, I recall a bug with fraglist udp where only first
packet in the batch had headers changed.

[..]
> udp      17 119 src=185.243.112.54 dst=37.34.63.177 sport=52775 dport=161 packets=4 bytes=267 src=192.168.4.2 dst=185.243.112.54 sport=161 dport=52775 packets=1 bytes=80 [ASSURED] mark=0 use=1
> udp      17 119 src=185.243.112.54 dst=37.34.63.177 sport=52775 dport=161 packets=5 bytes=334 src=192.168.4.2 dst=185.243.112.54 sport=161 dport=52775 packets=1 bytes=80 [ASSURED] mark=0 use=1
> udp      17 119 src=185.243.112.54 dst=37.34.63.177 sport=52775 dport=161 packets=6 bytes=401 src=192.168.4.2 dst=185.243.112.54 sport=161 dport=52775 packets=1 bytes=80 [ASSURED] mark=0 use=1
> udp      17 119 src=185.243.112.54 dst=37.34.63.177 sport=52775 dport=161 packets=7 bytes=468 src=192.168.4.2 dst=185.243.112.54 sport=161 dport=52775 packets=1 bytes=80 [ASSURED] mark=0 use=1
> udp      17 118 src=185.243.112.54 dst=37.34.63.177 sport=52775 dport=161 packets=7 bytes=468 src=192.168.4.2 dst=185.243.112.54 sport=161 dport=52775 packets=1 bytes=80 [ASSURED] mark=0 use=1
> ...
> 
> So yes, increating packet/byte counters.

[..]

> [Thu Sep  2 19:40:54 2021] nf_ct_proto_17: bad checksum IN= OUT= SRC=192.168.4.2 DST=185.243.112.54 LEN=82 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=161 DPT=56523 LEN=61

So reverse direction packets are deemed invalid and are thus not reverse-translated.

This is a bug, but not sure where.  What driver/nic is feeding these
packets to stack?

sysctl net.netfilter.nf_conntrack_checksum=0

should make things "work".