Hello, I recently upgraded kernel from linux-image-2.6.17.14-grsec2.1.9-vs2.0.2.1 to linux-image-2.6.21.6-grsec2.1.10-200706182032-vs2.2.0.3 Since then I have some troubles in vpn routing. My setup: one vserver with openvpn inside, bcap NET_ADMIN vserver_vpn public IP A.A.A.148 (if=ETH_R) vserver_vpn private IP on a tap 192.168.6.103 (if=tap2) MAIN public IP A.A.A.A.155 (if=ETH_R) I connect from outside(laptop) to the vpn, no problem, remote vpn IP=192.168.1.2 laptop# ping A.A.A.148 -> ok laptop# ping A.A.A.155 -> ok MAIN# ping 192.168.6.2 -> ok vserver_vpn# ping 192.168.6.2 -> ok laptop# ping 64.233.183.99 (google) -> no reply More precisely: there is a reply up to the server: MAIN# tcpdump -i ETH_R -l -n icmp 10:37:38.281783 IP A.A.A.155 > 64.233.183.99: ICMP echo request, id 6939, seq 1, length 64 10:37:38.286997 IP 64.233.183.99 > A.A.A.155: ICMP echo reply, id 6939, seq 1, length 64 MAIN# tcpdump -i tap2 -l -n icmp 10:38:00.280136 IP 192.168.6.2 > 64.233.183.99: ICMP echo request, id 6939, seq 23, length 64 So private address was properly NATed, ping routed, sent and received properly, but the answer packet was never forwarded back through the vpn. Relevant iptables snippet: iptables -t nat -A POSTROUTING -s 192.168.6.0/24 -o ETH_R -j MASQUERADE This setup worked for months before the kernel upgrade. I also noted that the netfilter modules changed quite a lot. Is there something new to do with iptables to get the stuff working again? Material is in a datacenter 200km away temporarely without PDU and serial console so I prefer not to change the kernel remotely "just to see" for now. Thanks for any idea. Phil vserver-info Versions: Kernel: 2.6.21.6-grsec2.1.10-200706182032-vs2.2.0.3 VS-API: 0x00020200 util-vserver: 0.30.213; May 7 2007, 04:20:41 Features: CC: gcc, gcc (GCC) 4.1.3 20070429 (prerelease) (Debian 4.1.2-5 ) CXX: g++, g++ (GCC) 4.1.3 20070429 (prerelease) (Debian 4.1.2-5 ) CPPFLAGS: '' CFLAGS: '-Wall -g -O2 -std=c99 -Wall -pedantic -W -funit-at-a-tim e' CXXFLAGS: '-g -O2 -ansi -Wall -pedantic -W -fmessage-length=0 -funit -at-a-time' build/host: x86_64-pc-linux-gnu/x86_64-pc-linux-gnu Use dietlibc: yes Build C++ programs: yes Build C99 programs: yes Available APIs: compat,v11,fscompat,v13,net,v21,oldproc,olduts ext2fs Source: e2fsprogs syscall(2) invocation: alternative vserver(2) syscall#: 236/glibc Paths: prefix: /usr sysconf-Directory: /etc cfg-Directory: /etc/vservers initrd-Directory: $(sysconfdir)/init.d pkgstate-Directory: /var/run/vservers vserver-Rootdir: /var/lib/vservers Assumed 'SYSINFO' as no other option given; try '--help' for more information.