Hi Lennert, >We do it in POSTROUTING and that seems to work fine? Indeed. I just tried and it looks like I could replace tproxy by a simple SNAT and finally upgrade to a newer kernel. Of course, it's not giving the real IP address, but at least some address that remains the same over time. Jan Engelhardt --