Closing remarks and the solution of the problem:
We can conclude that *using 169.254.x.x for routed networks is not in
accordance with standards.*
According to the standards the router shouldn't forward such packages
(from 169.254.x.x network) and even the client shouldn't send such
packages to the router.
Linux firewall will forward anything you configure it to. So you can
configure it to forward 169.254.x.x packages.
I think in doesn't have anything to do with standards — you configure
the router as you want (you should obey standards).
Debian Jessie as a client also obey the standard (contrary to older
Debian releases) it doesn't send the packages addressed outside from
169.254.x.x network to the router. It normally sends packages to the
other computers in 169.254.x.x network including the router but does not
send the traffic directed outside 169.254.x.x network. All packages
which before were sent to the router and NATed now are dropped.
This is done by setting interface/link "scope" property to 253 (it means
"local link"). The packages directed outside (to NAT) from such
interface are dropped.
One can check the scope by "ip a"
inet 169.254.1.61/24 brd 169.254.1.255 scope *link* eth0
It is possible to set scope to 0 ("global") something like by this:
ip a a 169.254.1.61/23 dev eth0 scope 0
(of course you have to delete the old interface config for example by:
"ip a d 169.254.1.61/23 dev eth0"
than you can see this in "ip a" output
inet 169.254.1.61/24 brd 169.254.1.255 scope *global* eth0
Now the client starts to send packets from 169.254.x.x to be NATed by a
gateway.
Now the note for insubordinate administrators who don't like obey the
rules in their private networks (as me:)
*The scope could be configured by DHCP server.*
For dhcpd you need to put "option non-local-source-routing true;" in
subnet configuration of dhcpd.conf
It looks like this:
subnet 169.254.1.0 netmask 255.255.255.0 {
authoritative;
range 169.254.1.10 169.254.1.249;
option subnet-mask 255.255.255.0;
option routers 169.254.1.1;
default-lease-time 3600;
max-lease-time 9900;
option domain-name-servers x.x.x.x, y.y.y.y;
option non-local-source-routing true;
}
Now the server push clients to set scope of the interface to 0;
You can do something opposite: configure the clients of some other ip
range to not send packed to router.
Maybe it will help somebody with the network as mine.
Regards,
Maciek
