iptables SNAt question

[Carsten Aulbert]

Finally, I have found the answer. Here it is for the archives:

Carsten Aulbert wrote:
> The setup (all boxes here are virtual Xen domains, but I don't think
> that's an issue here):

It is a Xen issue, it seems that the TCP checksum offloading does not
work right with feisty's Xen (3.0.4 IIRC). The cure is to run

ethtool -K eth0 tx off

on every domU guest.

I haven't looked hard enough at the tcpdump output, but wireshark
finally pointed the TCP checksum errors right into my face.

Carsten