Re: [netfilter-core] [NETFILTER] Apply IPsec to ipt_REJECT packets

[Patrick McHardy <kaber@xxxxxxxxx>]

Herbert Xu wrote:

> On Tue, Nov 23, 2004 at 07:17:36PM +0100, Patrick McHardy wrote:
>  
>
> > The patch doesn't handle tcp resets sent in response to a forwarded packet.
> > I'll send a patch later tonight.
> >    
> Isn't that handled by ip_forward itself?
>  
No. ip_forward handles the original packet, not the packet generated
by ipt_REJECT. RSTs generated in NF_IP_FORWARD are routed using
ip_route_input because they have a non-local source, so xfrm_route_forward
or xfrm_lookup needs to be called for them.

Regards
Patrick