From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pascal Hambourg Subject: Re: Full NAT forward and source routing - possible without packet marking? Date: Sun, 2 Jul 2017 19:10:34 +0200 Message-ID: References: <1363a246-966e-59fc-7d5a-efaf12aa6b51@dynator.no> <4c60ba2e-3e52-f55d-96e1-699c7821940d@pobox.com> <520045a0-9f63-04f0-cd4e-7c791762401b@plouf.fr.eu.org> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="iso-8859-1"; format="flowed" To: oyvind@dynator.no, netfilter@vger.kernel.org Le 02/07/2017 =E0 17:58, =D8yvind Kaurstad a =E9crit : > > Not sure if this clarified anything There was no need to clarify anything to me. Your original post was=20 clear enough, except the reason for the internal SNAT that you explained=20 but which is irrelevant, as you mentionned. However, hopefully that will=20 help other readers concentrate on the real issue. > but it still seems to me I need to leverage the connection tracking > with packet marking to be able to ensure the reply packets that should > go back out a non-default route actually does that. I'm afraid so, unless you can add a second IP address to the target device.