fxp2001640...@gmail.com <fxp2001640...@gmail.com> wrote: > From: Xiaoping Fan <x...@codeaurora.org> > > In some case, bridged packet will come back again for routing. When bridge > netfilter is enabled, a null snat rule is assigned to bridged packet if no > matching in nat chain. Then nat rule matching is skipped when packet comes > back for routing. This result in private IP address exported to public > network. So we don't assign a null snat rule to bridged traffic if no > matching.
This looks bogus. However, we already have issue with existing iptables nat vs nftables nat. So I think it might make sense to delay NULL binding allocation until we confirm the conntrack so users don't have to rmmod iptable_nat anymore when they use nftables as well.
