Re: Possible bug when bridging traffic we just SNATed and sent to another router

[Florian Westphal <fw@strlen.de>]

Daniel Collins <daniel.collins@smoothwall.net> wrote:
> Hi
> 
> We have encountered problems when attempting to bridge packets that we
> just sent, then saw a second time as the receiving router forwarded
> them to another router attached to a different bridge port.

I have no idea what that means.
-v please.

> This only occurs when SNAT was used on the original connection, this
> seems to prevent the original conntrack entry from being used for the
> bridged packet,

Uhh.. what?
Not following, sorry :-/

> instead creating a new one for them, our router's

If a new conntrack is created, then the skb did not (yet) have a conntrack
entry or something has caused the conntrack to be destroyed/discarded.

The latter typically happens with veth, or other
virtualization/container use cases where skb_scrub_packet() is called.

> router then sends the replies directly to us (as you'd expect), but
> Linux only undoes the first layer of NAT and then discards the packet
> since a local socket for it doesn't exist.

again, no idea what that means.  Please explain in more detail or
provide some graph that describes what is connected where, how the
routing happens and where bridge(s) are sitting.