2.6.31 iptables ignores reply pkt at interface SNAT+VLAN
Hi, I have a bit complex iptables+nat+mangle+vlan's setup within my box working perfectly with 2.6.30 and previous kernel versions. However, If I boot 2.6.31 then one of the capabilities stops working.
Replay packet's are silently ignored "only" at the interface doing SNAT+vlan. Rest of actions: iptables, nat, mangle's, policy based routing and NAT (no vlan) are working perfectly. To simplify the problem, here is the relevant setup and config:
["uid 1500" wget from 188.8.131.52]
LOCALHOST(10.0.0.1)vlan400 ==== (10.0.0.2)ROUTER ==== "MyPrivate" host(184.108.40.206)
With this setup, all network traffic originated by user id 1500 should check first the "MyPrivate" table and if destination is 220.127.116.11 then send it out through vlan400 interface and perform source NAT.
# echo "100 MyPrivate" >> /etc/iproute2/rt_tables
# ip route add 10.0.0.1/24 dev vlan400 table MyPrivate
# ip route add 18.104.22.168/8 via 10.0.0.2 table MyPrivate
# iptables -A OUTPUT -t mangle -m owner --uid-owner 1500 -j MARK --set-mark 1500
# ip rule add fwmark 1500 table MyPrivate
# iptables -t nat -A POSTROUTING -o vlan400 -j SNAT --to-source 10.0.0.1
# echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
Starts ok, traffic goes out on "vlan400" and remote host reply is correct, but then it stops. My localhost is not sending the last ACK, looks like it never sees the reply (SYN, ACK)
Just booting back with 2.6.30 starts working perfect again.
$ (running uid 1500)
$ wget from 22.214.171.124
10.0.0.1 SYN -->
<-- SYN, ACK 126.96.36.199
I've made lots of tests, googled, etc. but couldn't find anything, only some references to some issues corrected on 2.6.31 regarding NAT and connection tracking, but none similar to mine. Iptables version is not the problem, used 1.4.2, 1.4.3, 1.4.5 and allways works with kernel < 2.6.31.
Anybody knows if something important has been changed with 2.6.31? any idea?
Thanks in advance,