Hi, Thanks for your quick and detailed reply!
On Wed, May 2, 2018 at 12:24 AM, Florian Westphal <f...@strlen.de> wrote: > I'm not sure what the best way to solve this is, we either need > to insert earlier in nfqueue case, or do conflict resolution in nfqueue > case (and perhaps also nat undo? not sure). My knowledge of the conntrack/nat subsystem is not that great, and I don't know the implications of what I am about to suggest. However, considering that the two packets represent the same flow, wouldn't it be possible to apply the existing nat-mapping to the second packet, and then let the second packet pass? BR, Kristian
