From f3143a54a87a5d71b8b42feaaa9f6df0a6cded1b Mon Sep 17 00:00:00 2001 From: lgcosta Date: Wed, 11 Nov 2026 20:23:44 -0300 Subject: [PATCH] nat: route the reverse-translated packet with an empty source (kernel rejects non-local saddr) --- module/pfsrc/pfk_hooks.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/module/pfsrc/pfk_hooks.c b/module/pfsrc/pfk_hooks.c index 4667bfa..5dbb283 100644 --- a/module/pfsrc/pfk_hooks.c +++ b/module/pfsrc/pfk_hooks.c @@ -86,7 +86,12 @@ pfk_reroute(struct sk_buff *skb) struct iphdr *iph = ip_hdr(skb); fl4.daddr = iph->daddr; - fl4.saddr = iph->saddr; + /* + * Leave the source empty: the packet keeps the original source + * (the peer's address), but the kernel would reject a route lookup + * with a non-local source (ENETUNREACH). + */ + fl4.saddr = 0; fl4.flowi4_oif = 0; fl4.flowi4_mark = 0; fl4.flowi4_scope = RT_SCOPE_UNIVERSE;