diff -urp v2.6.39-before-nf_reroute/linux/include/net/flow.h linux/include/net/flow.h
--- v2.6.39-before-nf_reroute/linux/include/net/flow.h	2011-05-14 14:24:38.000000000 +0300
+++ linux/include/net/flow.h	2011-05-15 14:07:59.977246129 +0300
@@ -68,6 +68,7 @@ struct flowi4 {
 #define fl4_ipsec_spi		uli.spi
 #define fl4_mh_type		uli.mht.type
 #define fl4_gre_key		uli.gre_key
+	__be32			fl4_gw;
 };
 
 struct flowi6 {
diff -urp v2.6.39-before-nf_reroute/linux/include/net/netfilter/nf_nat.h linux/include/net/netfilter/nf_nat.h
--- v2.6.39-before-nf_reroute/linux/include/net/netfilter/nf_nat.h	2011-05-14 14:24:38.000000000 +0300
+++ linux/include/net/netfilter/nf_nat.h	2011-05-15 14:07:59.978246172 +0300
@@ -75,6 +75,13 @@ struct nf_conn_nat {
 #endif
 };
 
+/* Call input routing for SNAT-ed traffic */
+extern unsigned int ip_nat_route_input(unsigned int hooknum,
+				       struct sk_buff *skb,
+				       const struct net_device *in,
+				       const struct net_device *out,
+				       int (*okfn)(struct sk_buff *));
+
 /* Set up the info structure to map into this range. */
 extern unsigned int nf_nat_setup_info(struct nf_conn *ct,
 				      const struct nf_nat_range *range,
diff -urp v2.6.39-before-nf_reroute/linux/include/net/route.h linux/include/net/route.h
--- v2.6.39-before-nf_reroute/linux/include/net/route.h	2011-05-14 14:24:38.000000000 +0300
+++ linux/include/net/route.h	2011-05-15 14:07:59.979245372 +0300
@@ -56,6 +56,8 @@ struct rtable {
 	/* Lookup key. */
 	__be32			rt_key_dst;
 	__be32			rt_key_src;
+	__be32			rt_key_lsrc;
+	__be32			rt_key_gw;
 
 	int			rt_genid;
 	unsigned		rt_flags;
@@ -196,6 +198,7 @@ static inline int ip_route_input_noref(s
 	return ip_route_input_common(skb, dst, src, tos, devin, true);
 }
 
+extern int		ip_route_input_lookup(struct sk_buff*, __be32 dst, __be32 src, u8 tos, struct net_device *devin, __be32 lsrc);
 extern unsigned short	ip_rt_frag_needed(struct net *net, struct iphdr *iph, unsigned short new_mtu, struct net_device *dev);
 extern void		ip_rt_send_redirect(struct sk_buff *skb);
 
diff -urp v2.6.39-before-nf_reroute/linux/net/bridge/br_netfilter.c linux/net/bridge/br_netfilter.c
--- v2.6.39-before-nf_reroute/linux/net/bridge/br_netfilter.c	2011-05-14 14:24:40.000000000 +0300
+++ linux/net/bridge/br_netfilter.c	2011-05-15 14:07:59.980246190 +0300
@@ -403,6 +403,9 @@ static int br_nf_pre_routing_finish(stru
 	struct rtable *rt;
 	int err;
 
+	/* Old skb->dst is not expected, it is lost in all cases */
+	skb_dst_drop(skb);
+
 	if (nf_bridge->mask & BRNF_PKT_TYPE) {
 		skb->pkt_type = PACKET_OTHERHOST;
 		nf_bridge->mask ^= BRNF_PKT_TYPE;
diff -urp v2.6.39-before-nf_reroute/linux/net/ipv4/fib_semantics.c linux/net/ipv4/fib_semantics.c
--- v2.6.39-before-nf_reroute/linux/net/ipv4/fib_semantics.c	2011-05-14 20:59:53.430962883 +0300
+++ linux/net/ipv4/fib_semantics.c	2011-05-15 14:07:59.984246059 +0300
@@ -379,6 +379,9 @@ int fib_detect_death(struct fib_info *fi
 	for (nhsel = 0, nh = fi->fib_nh; nhsel < fi->fib_nhs; nh++, nhsel++) {
 		if (flp->flowi4_oif && flp->flowi4_oif != nh->nh_oif)
 			continue;
+		if (flp->fl4_gw && flp->fl4_gw != nh->nh_gw && nh->nh_gw &&
+		    nh->nh_scope == RT_SCOPE_LINK)
+			continue;
 		if (nh->nh_flags & RTNH_F_DEAD)
 			continue;
 
@@ -1331,6 +1334,10 @@ void fib_select_multipath(const struct f
 		change_nexthops(fi) {
 			if (flp->flowi4_oif != nexthop_nh->nh_oif)
 				continue;
+			if (flp->fl4_gw && flp->fl4_gw != nexthop_nh->nh_gw &&
+			    nexthop_nh->nh_gw &&
+			    nexthop_nh->nh_scope == RT_SCOPE_LINK)
+				continue;
 			if (!(nexthop_nh->nh_flags & RTNH_F_BADSTATE)) {
 				if (nexthop_nh->nh_power > w) {
 					w = nexthop_nh->nh_power;
@@ -1392,6 +1399,9 @@ last_resort:
 		if (!(nh->nh_flags & RTNH_F_DEAD)) {
 			if (flp->flowi4_oif && flp->flowi4_oif != nh->nh_oif)
 				continue;
+			if (flp->fl4_gw && flp->fl4_gw != nh->nh_gw &&
+			    nh->nh_gw && nh->nh_scope == RT_SCOPE_LINK)
+				continue;
 			spin_unlock_bh(&fib_multipath_lock);
 			res->nh_sel = nhsel;
 			return;
diff -urp v2.6.39-before-nf_reroute/linux/net/ipv4/fib_trie.c linux/net/ipv4/fib_trie.c
--- v2.6.39-before-nf_reroute/linux/net/ipv4/fib_trie.c	2011-05-14 20:59:53.432963168 +0300
+++ linux/net/ipv4/fib_trie.c	2011-05-15 14:07:59.987245015 +0300
@@ -1380,6 +1380,9 @@ static int check_leaf(struct fib_table *
 					continue;
 				if (flp->flowi4_oif && flp->flowi4_oif != nh->nh_oif)
 					continue;
+				if (flp->fl4_gw && flp->fl4_gw != nh->nh_gw &&
+				    nh->nh_gw && nh->nh_scope == RT_SCOPE_LINK)
+					continue;
 
 #ifdef CONFIG_IP_FIB_TRIE_STATS
 				t->stats.semantic_match_passed++;
diff -urp v2.6.39-before-nf_reroute/linux/net/ipv4/netfilter/ipt_MASQUERADE.c linux/net/ipv4/netfilter/ipt_MASQUERADE.c
--- v2.6.39-before-nf_reroute/linux/net/ipv4/netfilter/ipt_MASQUERADE.c	2010-08-02 09:37:49.000000000 +0300
+++ linux/net/ipv4/netfilter/ipt_MASQUERADE.c	2011-05-15 14:07:59.987245015 +0300
@@ -51,7 +51,7 @@ masquerade_tg(struct sk_buff *skb, const
 	enum ip_conntrack_info ctinfo;
 	struct nf_nat_range newrange;
 	const struct nf_nat_multi_range_compat *mr;
-	const struct rtable *rt;
+	struct rtable *rt;
 	__be32 newsrc;
 
 	NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING);
@@ -69,13 +69,28 @@ masquerade_tg(struct sk_buff *skb, const
 		return NF_ACCEPT;
 
 	mr = par->targinfo;
-	rt = skb_rtable(skb);
-	newsrc = inet_select_addr(par->out, rt->rt_gateway, RT_SCOPE_UNIVERSE);
-	if (!newsrc) {
-		pr_info("%s ate my IP address\n", par->out->name);
-		return NF_DROP;
+
+	{
+		struct flowi4 fl4 = { .flowi4_tos = (RT_TOS(ip_hdr(skb)->tos) |
+						     RTO_CONN),
+				      .flowi4_mark = skb->mark,
+				      .flowi4_oif = par->out->ifindex,
+				      .daddr = ip_hdr(skb)->daddr,
+				      .fl4_gw = skb_rtable(skb)->rt_gateway };
+		rt = ip_route_output_key(dev_net(par->out), &fl4);
+		if (IS_ERR(rt)) {
+			/* Funky routing can do this. */
+			if (net_ratelimit())
+				pr_info("%s:"
+				       " No route: Rusty's brain broke!\n",
+				       par->out->name);
+			return NF_DROP;
+		}
 	}
 
+	newsrc = rt->rt_src;
+	ip_rt_put(rt);
+
 	nat->masq_index = par->out->ifindex;
 
 	/* Transfer from original range. */
diff -urp v2.6.39-before-nf_reroute/linux/net/ipv4/netfilter/nf_nat_core.c linux/net/ipv4/netfilter/nf_nat_core.c
--- v2.6.39-before-nf_reroute/linux/net/ipv4/netfilter/nf_nat_core.c	2011-05-14 14:24:41.000000000 +0300
+++ linux/net/ipv4/netfilter/nf_nat_core.c	2011-05-15 14:07:59.988245236 +0300
@@ -716,6 +716,52 @@ static struct pernet_operations nf_nat_n
 	.exit = nf_nat_net_exit,
 };
 
+unsigned int
+ip_nat_route_input(unsigned int hooknum,
+		struct sk_buff *skb,
+		const struct net_device *in,
+		const struct net_device *out,
+		int (*okfn)(struct sk_buff *))
+{
+	struct iphdr *iph;
+	struct nf_conn *conn;
+	enum ip_conntrack_info ctinfo;
+	enum ip_conntrack_dir dir;
+	unsigned long statusbit;
+	__be32 saddr;
+
+	if (!(conn = nf_ct_get(skb, &ctinfo)))
+		return NF_ACCEPT;
+
+	if (!(conn->status & IPS_NAT_DONE_MASK))
+		return NF_ACCEPT;
+	dir = CTINFO2DIR(ctinfo);
+	statusbit = IPS_SRC_NAT;
+	if (dir == IP_CT_DIR_REPLY)
+		statusbit ^= IPS_NAT_MASK;
+	if (!(conn->status & statusbit))
+		return NF_ACCEPT;
+
+	if (skb_dst(skb))
+		return NF_ACCEPT;
+
+	if (skb->len < sizeof(struct iphdr))
+		return NF_ACCEPT;
+
+	/* use daddr in other direction as masquerade address (lsrc) */
+	iph = ip_hdr(skb);
+	saddr = conn->tuplehash[!dir].tuple.dst.u3.ip;
+	if (saddr == iph->saddr)
+		return NF_ACCEPT;
+
+	if (ip_route_input_lookup(skb, iph->daddr, iph->saddr, iph->tos,
+	    skb->dev, saddr))
+		return NF_DROP;
+
+	return NF_ACCEPT;
+}
+EXPORT_SYMBOL_GPL(ip_nat_route_input);
+
 static int __init nf_nat_init(void)
 {
 	size_t i;
diff -urp v2.6.39-before-nf_reroute/linux/net/ipv4/netfilter/nf_nat_standalone.c linux/net/ipv4/netfilter/nf_nat_standalone.c
--- v2.6.39-before-nf_reroute/linux/net/ipv4/netfilter/nf_nat_standalone.c	2011-05-14 14:24:41.000000000 +0300
+++ linux/net/ipv4/netfilter/nf_nat_standalone.c	2011-05-15 14:07:59.988245236 +0300
@@ -250,6 +250,14 @@ static struct nf_hook_ops nf_nat_ops[] _
 		.hooknum	= NF_INET_PRE_ROUTING,
 		.priority	= NF_IP_PRI_NAT_DST,
 	},
+	/* Before routing, route before mangling */
+	{
+		.hook		= ip_nat_route_input,
+		.owner		= THIS_MODULE,
+		.pf		= NFPROTO_IPV4,
+		.hooknum	= NF_INET_PRE_ROUTING,
+		.priority	= NF_IP_PRI_LAST-1,
+	},
 	/* After packet filtering, change source */
 	{
 		.hook		= nf_nat_out,
diff -urp v2.6.39-before-nf_reroute/linux/net/ipv4/route.c linux/net/ipv4/route.c
--- v2.6.39-before-nf_reroute/linux/net/ipv4/route.c	2011-05-15 10:22:25.793246883 +0300
+++ linux/net/ipv4/route.c	2011-05-15 14:09:32.695246647 +0300
@@ -724,6 +724,8 @@ static inline int compare_keys(struct rt
 	return (((__force u32)rt1->rt_key_dst ^ (__force u32)rt2->rt_key_dst) |
 		((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
 		(rt1->rt_mark ^ rt2->rt_mark) |
+		((__force u32)rt1->rt_key_lsrc ^ (__force u32)rt2->rt_key_lsrc) |
+		((__force u32)rt1->rt_key_gw ^ (__force u32)rt2->rt_key_gw) |
 		(rt1->rt_tos ^ rt2->rt_tos) |
 		(rt1->rt_oif ^ rt2->rt_oif) |
 		(rt1->rt_iif ^ rt2->rt_iif)) == 0;
@@ -1614,6 +1616,8 @@ static int check_peer_redir(struct dst_e
 		rt->rt_gateway = orig_gw;
 		return -EAGAIN;
 	} else {
+		if (rt->rt_key_gw)
+			rt->rt_key_gw = rt->rt_gateway;
 		rt->rt_flags |= RTCF_REDIRECTED;
 		call_netevent_notifiers(NETEVENT_NEIGH_UPDATE,
 					rt->dst.neighbour);
@@ -1792,6 +1796,8 @@ static void rt_init_metrics(struct rtabl
 		if (peer->redirect_learned.a4 &&
 		    peer->redirect_learned.a4 != rt->rt_gateway) {
 			rt->rt_gateway = peer->redirect_learned.a4;
+			if (rt->rt_key_gw)
+				rt->rt_key_gw = rt->rt_gateway;
 			rt->rt_flags |= RTCF_REDIRECTED;
 		}
 	} else {
@@ -1887,6 +1893,7 @@ static int ip_route_input_mc(struct sk_b
 	rth->rt_tos	= tos;
 	rth->rt_mark    = skb->mark;
 	rth->rt_key_src	= saddr;
+	rth->rt_key_lsrc = 0;
 	rth->rt_src	= saddr;
 #ifdef CONFIG_IP_ROUTE_CLASSID
 	rth->dst.tclassid = itag;
@@ -1896,6 +1903,7 @@ static int ip_route_input_mc(struct sk_b
 	rth->dst.dev	= init_net.loopback_dev;
 	dev_hold(rth->dst.dev);
 	rth->rt_oif	= 0;
+	rth->rt_key_gw	= daddr;
 	rth->rt_gateway	= daddr;
 	rth->rt_spec_dst= spec_dst;
 	rth->rt_genid	= rt_genid(dev_net(dev));
@@ -1962,7 +1970,7 @@ static int __mkroute_input(struct sk_buf
 			   const struct fib_result *res,
 			   struct in_device *in_dev,
 			   __be32 daddr, __be32 saddr, u32 tos,
-			   struct rtable **result)
+			   __be32 lsrc, struct rtable **result)
 {
 	struct rtable *rth;
 	int err;
@@ -1994,6 +2002,7 @@ static int __mkroute_input(struct sk_buf
 		flags |= RTCF_DIRECTSRC;
 
 	if (out_dev == in_dev && err &&
+	    !lsrc &&
 	    (IN_DEV_SHARED_MEDIA(out_dev) ||
 	     inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
 		flags |= RTCF_DOREDIRECT;
@@ -2025,8 +2034,10 @@ static int __mkroute_input(struct sk_buf
 	rth->rt_tos	= tos;
 	rth->rt_mark    = skb->mark;
 	rth->rt_key_src	= saddr;
+	rth->rt_key_lsrc = lsrc;
 	rth->rt_src	= saddr;
 	rth->rt_gateway	= daddr;
+	rth->rt_key_gw	= 0;
 	rth->rt_route_iif = in_dev->dev->ifindex;
 	rth->rt_iif 	= in_dev->dev->ifindex;
 	rth->dst.dev	= (out_dev)->dev;
@@ -2053,7 +2064,7 @@ static int ip_mkroute_input(struct sk_bu
 			    struct net *net,
 			    const struct flowi4 *fl4,
 			    struct in_device *in_dev,
-			    __be32 daddr, __be32 saddr, u32 tos)
+			    __be32 daddr, __be32 saddr, u32 tos, __be32 lsrc)
 {
 	struct rtable* rth = NULL;
 	int err;
@@ -2066,7 +2077,7 @@ static int ip_mkroute_input(struct sk_bu
 #endif
 
 	/* create a routing cache entry */
-	err = __mkroute_input(skb, res, in_dev, daddr, saddr, tos, &rth);
+	err = __mkroute_input(skb, res, in_dev, daddr, saddr, tos, lsrc, &rth);
 	if (err)
 		return err;
 
@@ -2091,7 +2102,7 @@ static int ip_mkroute_input(struct sk_bu
  */
 
 static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
-			       u8 tos, struct net_device *dev)
+			       u8 tos, struct net_device *dev, __be32 lsrc)
 {
 	struct fib_result res;
 	struct in_device *in_dev = __in_dev_get_rcu(dev);
@@ -2129,22 +2140,32 @@ static int ip_route_input_slow(struct sk
 	if (ipv4_is_zeronet(daddr) || ipv4_is_loopback(daddr))
 		goto martian_destination;
 
+	if (lsrc) {
+		if (ipv4_is_multicast(lsrc) || ipv4_is_lbcast(lsrc) ||
+		    ipv4_is_zeronet(lsrc) || ipv4_is_loopback(lsrc))
+			goto e_inval;
+	}
+
 	/*
 	 *	Now we are ready to route packet.
 	 */
 	fl4.flowi4_oif = 0;
-	fl4.flowi4_iif = dev->ifindex;
+	fl4.flowi4_iif = lsrc ?
+			 dev_net(dev)->loopback_dev->ifindex : dev->ifindex;
 	fl4.flowi4_mark = skb->mark;
 	fl4.flowi4_tos = tos;
 	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
 	fl4.daddr = daddr;
-	fl4.saddr = saddr;
+	fl4.saddr = lsrc? : saddr;
+	fl4.fl4_gw = 0;
 	err = fib_lookup(net, &fl4, &res);
 	if (err != 0) {
 		if (!IN_DEV_FORWARD(in_dev))
 			goto e_hostunreach;
 		goto no_route;
 	}
+	fl4.flowi4_iif = dev->ifindex;
+	fl4.saddr = saddr;
 
 	RT_CACHE_STAT_INC(in_slow_tot);
 
@@ -2168,12 +2189,15 @@ static int ip_route_input_slow(struct sk
 	if (res.type != RTN_UNICAST)
 		goto martian_destination;
 
-	err = ip_mkroute_input(skb, &res, net, &fl4, in_dev, daddr, saddr, tos);
+	err = ip_mkroute_input(skb, &res, net, &fl4, in_dev, daddr, saddr,
+		tos, lsrc);
 out:	return err;
 
 brd_input:
 	if (skb->protocol != htons(ETH_P_IP))
 		goto e_inval;
+	if (lsrc)
+		goto e_inval;
 
 	if (ipv4_is_zeronet(saddr))
 		spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
@@ -2210,6 +2234,7 @@ local_input:
 	rth->rt_iif	= dev->ifindex;
 	rth->dst.dev	= net->loopback_dev;
 	dev_hold(rth->dst.dev);
+	rth->rt_key_gw	= 0;
 	rth->rt_gateway	= daddr;
 	rth->rt_spec_dst= spec_dst;
 	rth->dst.input= ip_local_deliver;
@@ -2265,8 +2290,9 @@ martian_source_keep_err:
 	goto out;
 }
 
-int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
-			   u8 tos, struct net_device *dev, bool noref)
+int ip_route_input_cached(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+			   u8 tos, struct net_device *dev, bool noref,
+			   __be32 lsrc)
 {
 	struct rtable * rth;
 	unsigned	hash;
@@ -2289,6 +2315,7 @@ int ip_route_input_common(struct sk_buff
 		if ((((__force u32)rth->rt_key_dst ^ (__force u32)daddr) |
 		     ((__force u32)rth->rt_key_src ^ (__force u32)saddr) |
 		     (rth->rt_iif ^ iif) |
+		     (rth->rt_key_lsrc ^ lsrc) |
 		     rth->rt_oif |
 		     (rth->rt_tos ^ tos)) == 0 &&
 		    rth->rt_mark == skb->mark &&
@@ -2342,12 +2369,25 @@ skip_cache:
 		rcu_read_unlock();
 		return -EINVAL;
 	}
-	res = ip_route_input_slow(skb, daddr, saddr, tos, dev);
+	res = ip_route_input_slow(skb, daddr, saddr, tos, dev, lsrc);
 	rcu_read_unlock();
 	return res;
 }
+
+int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+			  u8 tos, struct net_device *dev, bool noref)
+{
+	return ip_route_input_cached(skb, daddr, saddr, tos, dev, noref, 0);
+}
 EXPORT_SYMBOL(ip_route_input_common);
 
+int ip_route_input_lookup(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+			  u8 tos, struct net_device *dev, __be32 lsrc)
+{
+	return ip_route_input_cached(skb, daddr, saddr, tos, dev, true, lsrc);
+}
+EXPORT_SYMBOL(ip_route_input_lookup);
+
 /* called with rcu_read_lock() */
 static struct rtable *__mkroute_output(const struct fib_result *res,
 				       const struct flowi4 *fl4,
@@ -2403,6 +2443,7 @@ static struct rtable *__mkroute_output(c
 	rth->rt_tos	= tos;
 	rth->rt_key_src	= oldflp4->saddr;
 	rth->rt_oif	= oldflp4->flowi4_oif;
+	rth->rt_key_gw	= oldflp4->fl4_gw;
 	rth->rt_mark    = oldflp4->flowi4_mark;
 	rth->rt_dst	= fl4->daddr;
 	rth->rt_src	= fl4->saddr;
@@ -2473,6 +2514,7 @@ static struct rtable *ip_route_output_sl
 	fl4.flowi4_mark = oldflp4->flowi4_mark;
 	fl4.daddr = oldflp4->daddr;
 	fl4.saddr = oldflp4->saddr;
+	fl4.fl4_gw = oldflp4->fl4_gw;
 	fl4.flowi4_tos = tos & IPTOS_RT_MASK;
 	fl4.flowi4_scope = ((tos & RTO_ONLINK) ?
 			RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
@@ -2562,6 +2604,7 @@ static struct rtable *ip_route_output_sl
 			fl4.daddr = fl4.saddr = htonl(INADDR_LOOPBACK);
 		dev_out = net->loopback_dev;
 		fl4.flowi4_oif = net->loopback_dev->ifindex;
+		fl4.fl4_gw = 0;
 		res.type = RTN_LOCAL;
 		flags |= RTCF_LOCAL;
 		goto make_route;
@@ -2607,6 +2650,7 @@ static struct rtable *ip_route_output_sl
 		}
 		dev_out = net->loopback_dev;
 		fl4.flowi4_oif = dev_out->ifindex;
+		fl4.fl4_gw = 0;
 		res.fi = NULL;
 		flags |= RTCF_LOCAL;
 		goto make_route;
@@ -2658,6 +2702,7 @@ struct rtable *__ip_route_output_key(str
 		    rth->rt_key_src == flp4->saddr &&
 		    rt_is_output_route(rth) &&
 		    rth->rt_oif == flp4->flowi4_oif &&
+		    rth->rt_key_gw == flp4->fl4_gw &&
 		    rth->rt_mark == flp4->flowi4_mark &&
 		    !((rth->rt_tos ^ flp4->flowi4_tos) &
 			    (IPTOS_RT_MASK | RTO_ONLINK)) &&
@@ -2739,6 +2784,8 @@ struct dst_entry *ipv4_blackhole_route(s
 		rt->rt_dst = ort->rt_dst;
 		rt->rt_src = ort->rt_src;
 		rt->rt_gateway = ort->rt_gateway;
+		if (ort->rt_key_gw)
+			rt->rt_key_gw = rt->rt_gateway;
 		rt->rt_spec_dst = ort->rt_spec_dst;
 		rt->peer = ort->peer;
 		if (rt->peer)
