From mboxrd@z Thu Jan 1 00:00:00 1970 From: Florian Westphal Subject: Re: nftables: masquerade sets wrong source address Date: Thu, 22 Dec 2016 11:34:48 +0100 Message-ID: <20161222103448.GA31504@breakpoint.cc> References: Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Tom Hacohen Cc: Liping Zhang , Pablo Neira Ayuso , netfilter@vger.kernel.org, Netfilter Developer Mailing List Tom Hacohen wrote: > I'm sorry for repeating myself, however I'd like to stress out again, > that while your workaround fixes an inconsistency between iptables and > nftables, the scenario itself is caused by the buggy behaviour of > masquerade with "lo", and that needs to be fixed too. The workaround > above, and any fixes to that issue will only fix the dropping of the > packets, but the wrong rewrite will still be there. The 'wrong rewrite' also occurs with iptables. It doesn't cause connectivity issues because in iptables the nat table always registers the output hook. (I agree that nft masquerade should not cause these connectivity issues, but I think proper ruleset fix is to use meta iif to restrict masq to the correct interface(s)).