iptables checksum

CHECKSUM

       This target allows to selectively work around broken/old applications.  It can only be used in the mangle table.

       --checksum-fill

              Compute and fill in the checksum in a packet that lacks a checksum.  This is particularly useful, if you need to work around old applications such as dhcp clients, that do not

              work well with checksum offloads, but don’t want to disable checksum offload in your device.

openstack 에서 아래와 같은 정책이 사용되긴 한데

-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill

UDP 68번 포트는 BOOTP Client 라고 되어 있음

bootpc          68/tcp                          # BOOTP client

bootpc          68/udp

BOOTP

네트워크 구성 정보를 얻기 위한 프로토콜