3 down vote favorite
I have a strange behaviour in my server setup. It looks like that.
client1 192.168.11.2/24 <----> 192.168.11.7/24 (br1/vlan1) Server 192.168.21.1/24 (br21/vlan21) <---> 192.168.21.101/24 client2
On the server I have set up DNAT for two ports to another destination.
~> sudo iptables -t nat -nL -v
Chain PREROUTING (policy ACCEPT 3631 packets, 220K bytes)
pkts bytes target prot opt in out source destination
5332 320K DNAT tcp -- * * 0.0.0.0/0 192.168.11.7 multiport dports 5308,21 to:192.168.2.19
~> ip r get 192.168.2.19 192.168.2.19 via 192.168.11.1 dev br1 src 192.168.11.7
This works for some time from both clients but after an unspecified time only packets from client2 are forwarded any more. The packet counter increases when I try to connect from client1 but there is no NAT any more. Sometimes it started to work again after some hours.
Nothing is blocked in the firewall because all policies are on ACCEPT and no rules where set. The conntrack is not full either. I already tried multiple things with rp_filter and so on but this should be no problem in these setup.
when I set br1 to promisc mode it starts working, but I want to understand why the interface doesn't accept the packets without promisc mode.
Hopefully someone has an idea.