firewall implementation and traffic forwarding about click

[ahenning]

Its probably worth looking at the Layer2 headers. The way I read the config the packets are going to leave ens5 with the same L2 headers as received on ens4, so even if the packet is forced onto the VM3 interface, VM3 will receive the packet with a destination mac that it probably does not own.

[p4pe]

Thank you for your answer @ahenning.
So your suggestion is to change the MAC address before the packet exits the ens5?

[pallas]

If these are layer 2 interfaces you likely need an arp querier/responder.

[p4pe]

@pallas no, we assume that these are L3 interfaces.