Okay so what's interesting is if I remove that rule.
sudo ip rule del from 10.89.0.0/24 lookup CONTAINERS
Set a mark
sudo iptables -t mangle -A PREROUTING -s 10.89.0.0/24 -j MARK --set-xmark 0x7/0xffffffff
Enable rp-filter:
https://sysctl-explorer.net/net/ipv4/rp_filter/
sudo sysctl -w net.ipv4.conf.all.rp_filter=2
sudo ip rule add fwmark 7 table CONTAINERS prio 700
things seem to work, there seems to be ARP replies making their way into
the container.
--
Daniel Gray 0x41911F722B0F9AE3
https://mastodon.social/@dngray