Subject: Re: Re-routing packets via netfilter (ip_rt_bug)

From: Patrick McHardy <[email-masked]>
Date: Wed, 27 Apr 2005 14:05:06 +0200

Herbert Xu wrote:
> Here is another reason why these packets should go through FORWARD.
> They were generated in response to packets in INPUT/FORWARD/OUTPUT.
> The original packet has not undergone SNAT in any of these cases.
> 
> However, if we feed the response packet through LOCAL_OUT it will
> be subject to DNAT.  This creates a NAT asymmetry and we may end
> up with the wrong destination address.
> 
> By pushing it through FORWARD it will only undergo SNAT which is
> correct since the original packet would have undergone DNAT.

This is only a problem since the recent NAT changes, but I agree
that we should fix it by moving these packets to FORWARD.

Regards
Patrick