diff -urp v5.18-before-nf_reroute/linux/include/net/flow.h linux/include/net/flow.h
--- v5.18-before-nf_reroute/linux/include/net/flow.h	2022-06-12 16:53:10.000000000 +0300
+++ linux/include/net/flow.h	2022-06-12 17:08:19.411321965 +0300
@@ -92,6 +92,7 @@ struct flowi4 {
 #define fl4_icmp_code		uli.icmpt.code
 #define fl4_mh_type		uli.mht.type
 #define fl4_gre_key		uli.gre_key
+	__be32			fl4_gw;
 } __attribute__((__aligned__(BITS_PER_LONG/8)));
 
 static inline void flowi4_init_output(struct flowi4 *fl4, int oif,
@@ -117,6 +118,7 @@ static inline void flowi4_init_output(st
 	fl4->fl4_dport = dport;
 	fl4->fl4_sport = sport;
 	fl4->flowi4_multipath_hash = 0;
+	fl4->fl4_gw = 0;
 }
 
 /* Reset some input parameters after previous lookup */
diff -urp v5.18-before-nf_reroute/linux/include/net/netfilter/nf_nat.h linux/include/net/netfilter/nf_nat.h
--- v5.18-before-nf_reroute/linux/include/net/netfilter/nf_nat.h	2022-06-12 16:53:10.000000000 +0300
+++ linux/include/net/netfilter/nf_nat.h	2022-06-12 17:08:19.411321965 +0300
@@ -35,6 +35,11 @@ struct nf_conn_nat {
 #endif
 };
 
+/* Call input routing for SNAT-ed traffic */
+unsigned int ip_nat_route_input(void *priv,
+				struct sk_buff *skb,
+				const struct nf_hook_state *state);
+
 /* Set up the info structure to map into this range. */
 unsigned int nf_nat_setup_info(struct nf_conn *ct,
 			       const struct nf_nat_range2 *range,
diff -urp v5.18-before-nf_reroute/linux/include/net/route.h linux/include/net/route.h
--- v5.18-before-nf_reroute/linux/include/net/route.h	2022-06-12 16:53:10.000000000 +0300
+++ linux/include/net/route.h	2022-06-12 17:08:19.412321953 +0300
@@ -191,6 +191,9 @@ int ip_route_input_noref(struct sk_buff
 int ip_route_input_rcu(struct sk_buff *skb, __be32 dst, __be32 src,
 		       u8 tos, struct net_device *devin,
 		       struct fib_result *res);
+int ip_route_input_common_rcu(struct sk_buff *skb, __be32 dst, __be32 src,
+			      u8 tos, struct net_device *devin, __be32 lsrc,
+			      struct fib_result *res);
 
 int ip_route_use_hint(struct sk_buff *skb, __be32 dst, __be32 src,
 		      u8 tos, struct net_device *devin,
@@ -230,6 +233,8 @@ unsigned int inet_addr_type_dev_table(st
 void ip_rt_multicast_event(struct in_device *);
 int ip_rt_ioctl(struct net *, unsigned int cmd, struct rtentry *rt);
 void ip_rt_get_source(u8 *src, struct sk_buff *skb, struct rtable *rt);
+int ip_route_input_lookup(struct sk_buff*, __be32 dst, __be32 src, u8 tos,
+			  struct net_device *devin, __be32 lsrc);
 struct rtable *rt_dst_alloc(struct net_device *dev,
 			     unsigned int flags, u16 type,
 			     bool nopolicy, bool noxfrm);
diff -urp v5.18-before-nf_reroute/linux/net/bridge/br_netfilter_hooks.c linux/net/bridge/br_netfilter_hooks.c
--- v5.18-before-nf_reroute/linux/net/bridge/br_netfilter_hooks.c	2022-06-12 16:53:10.000000000 +0300
+++ linux/net/bridge/br_netfilter_hooks.c	2022-06-12 17:08:19.413321940 +0300
@@ -359,6 +359,9 @@ static int br_nf_pre_routing_finish(stru
 
 	nf_bridge->frag_max_size = IPCB(skb)->frag_max_size;
 
+	/* Old skb->dst is not expected, it is lost in all cases */
+	skb_dst_drop(skb);
+
 	if (nf_bridge->pkt_otherhost) {
 		skb->pkt_type = PACKET_OTHERHOST;
 		nf_bridge->pkt_otherhost = false;
diff -urp v5.18-before-nf_reroute/linux/net/core/filter.c linux/net/core/filter.c
--- v5.18-before-nf_reroute/linux/net/core/filter.c	2022-06-12 16:53:10.000000000 +0300
+++ linux/net/core/filter.c	2022-06-12 17:08:19.417321892 +0300
@@ -5717,6 +5717,7 @@ static int bpf_ipv4_fib_lookup(struct ne
 	fl4.fl4_sport = params->sport;
 	fl4.fl4_dport = params->dport;
 	fl4.flowi4_multipath_hash = 0;
+	fl4.fl4_gw = 0;
 
 	if (flags & BPF_FIB_LOOKUP_DIRECT) {
 		u32 tbid = l3mdev_fib_table_rcu(dev) ? : RT_TABLE_MAIN;
diff -urp v5.18-before-nf_reroute/linux/net/ipv4/fib_frontend.c linux/net/ipv4/fib_frontend.c
--- v5.18-before-nf_reroute/linux/net/ipv4/fib_frontend.c	2022-06-12 17:00:35.000020833 +0300
+++ linux/net/ipv4/fib_frontend.c	2022-06-12 17:08:19.418321879 +0300
@@ -370,6 +370,7 @@ static int __fib_validate_source(struct
 	fl4.flowi4_flags = 0;
 	fl4.flowi4_uid = sock_net_uid(net, NULL);
 	fl4.flowi4_multipath_hash = 0;
+	fl4.fl4_gw = 0;
 
 	no_addr = idev->ifa_list == NULL;
 
diff -urp v5.18-before-nf_reroute/linux/net/ipv4/fib_semantics.c linux/net/ipv4/fib_semantics.c
--- v5.18-before-nf_reroute/linux/net/ipv4/fib_semantics.c	2022-06-12 17:02:00.123976268 +0300
+++ linux/net/ipv4/fib_semantics.c	2022-06-12 17:08:19.420321855 +0300
@@ -561,6 +561,9 @@ static int fib_detect_death(struct fib_i
 		nhc = fib_info_nhc(fi, nhsel);
 		if (flp->flowi4_oif && flp->flowi4_oif != nhc->nhc_oif)
 			continue;
+		if (flp->fl4_gw && flp->fl4_gw != nhc->nhc_gw.ipv4 &&
+		    nhc->nhc_gw.ipv4 && nhc->nhc_scope == RT_SCOPE_LINK)
+			continue;
 		if (nhc->nhc_flags & RTNH_F_DEAD)
 			continue;
 
diff -urp v5.18-before-nf_reroute/linux/net/ipv4/fib_trie.c linux/net/ipv4/fib_trie.c
--- v5.18-before-nf_reroute/linux/net/ipv4/fib_trie.c	2022-06-12 16:53:10.000000000 +0300
+++ linux/net/ipv4/fib_trie.c	2022-06-12 17:09:08.386720978 +0300
@@ -1432,6 +1432,10 @@ bool fib_lookup_good_nhc(const struct fi
 	if (flp->flowi4_oif && flp->flowi4_oif != nhc->nhc_oif)
 		return false;
 
+	if (flp->fl4_gw && flp->fl4_gw != nhc->nhc_gw.ipv4 &&
+	    nhc->nhc_gw.ipv4 && nhc->nhc_scope == RT_SCOPE_LINK)
+		return false;
+
 	return true;
 }
 
diff -urp v5.18-before-nf_reroute/linux/net/ipv4/netfilter/iptable_nat.c linux/net/ipv4/netfilter/iptable_nat.c
--- v5.18-before-nf_reroute/linux/net/ipv4/netfilter/iptable_nat.c	2022-06-12 16:53:10.000000000 +0300
+++ linux/net/ipv4/netfilter/iptable_nat.c	2022-06-12 17:08:19.422321831 +0300
@@ -48,6 +48,13 @@ static const struct nf_hook_ops nf_nat_i
 		.hooknum	= NF_INET_LOCAL_OUT,
 		.priority	= NF_IP_PRI_NAT_DST,
 	},
+	/* Before routing, route before mangling */
+	{
+		.hook		= ip_nat_route_input,
+		.pf		= NFPROTO_IPV4,
+		.hooknum	= NF_INET_PRE_ROUTING,
+		.priority	= NF_IP_PRI_LAST-1,
+	},
 	{
 		.hook		= ipt_do_table,
 		.pf		= NFPROTO_IPV4,
diff -urp v5.18-before-nf_reroute/linux/net/ipv4/route.c linux/net/ipv4/route.c
--- v5.18-before-nf_reroute/linux/net/ipv4/route.c	2022-06-12 17:00:35.005020772 +0300
+++ linux/net/ipv4/route.c	2022-06-12 17:10:34.417665274 +0300
@@ -1793,7 +1793,7 @@ static void ip_handle_martian_source(str
 static int __mkroute_input(struct sk_buff *skb,
 			   const struct fib_result *res,
 			   struct in_device *in_dev,
-			   __be32 daddr, __be32 saddr, u32 tos)
+			   __be32 daddr, __be32 saddr, u32 tos, __be32 lsrc)
 {
 	struct fib_nh_common *nhc = FIB_RES_NHC(*res);
 	struct net_device *dev = nhc->nhc_dev;
@@ -1822,7 +1822,7 @@ static int __mkroute_input(struct sk_buf
 
 	do_cache = res->fi && !itag;
 	if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
-	    skb->protocol == htons(ETH_P_IP)) {
+	    skb->protocol == htons(ETH_P_IP) && !lsrc) {
 		__be32 gw;
 
 		gw = nhc->nhc_gw_family == AF_INET ? nhc->nhc_gw.ipv4 : 0;
@@ -2144,7 +2144,7 @@ static int ip_mkroute_input(struct sk_bu
 			    const struct flowi4 *fl4,
 			    struct in_device *in_dev,
 			    __be32 daddr, __be32 saddr, u32 tos,
-			    struct flow_keys *hkeys)
+			    struct flow_keys *hkeys, __be32 lsrc)
 {
 	fib_select_default(fl4, res);
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
@@ -2156,7 +2156,7 @@ static int ip_mkroute_input(struct sk_bu
 #endif
 
 	/* create a routing cache entry */
-	return __mkroute_input(skb, res, in_dev, daddr, saddr, tos);
+	return __mkroute_input(skb, res, in_dev, daddr, saddr, tos, lsrc);
 }
 
 /* Implements all the saddr-related checks as ip_route_input_slow(),
@@ -2226,7 +2226,7 @@ static struct net_device *ip_rt_get_dev(
  */
 
 static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
-			       u8 tos, struct net_device *dev,
+			       u8 tos, struct net_device *dev, __be32 lsrc,
 			       struct fib_result *res)
 {
 	struct in_device *in_dev = __in_dev_get_rcu(dev);
@@ -2285,20 +2285,27 @@ static int ip_route_input_slow(struct sk
 			goto martian_source;
 	}
 
+	if (lsrc) {
+		if (ipv4_is_multicast(lsrc) || ipv4_is_lbcast(lsrc) ||
+		    ipv4_is_zeronet(lsrc) || ipv4_is_loopback(lsrc))
+			goto martian_source;
+	}
+
 	/*
 	 *	Now we are ready to route packet.
 	 */
 	fl4.flowi4_l3mdev = 0;
 	fl4.flowi4_oif = 0;
-	fl4.flowi4_iif = dev->ifindex;
+	fl4.flowi4_iif = lsrc ? LOOPBACK_IFINDEX : dev->ifindex;
 	fl4.flowi4_mark = skb->mark;
 	fl4.flowi4_tos = tos;
 	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
 	fl4.flowi4_flags = 0;
 	fl4.daddr = daddr;
-	fl4.saddr = saddr;
+	fl4.saddr = lsrc? : saddr;
 	fl4.flowi4_uid = sock_net_uid(net, NULL);
 	fl4.flowi4_multipath_hash = 0;
+	fl4.fl4_gw = 0;
 
 	if (fib4_rules_early_flow_dissect(net, skb, &fl4, &_flkeys)) {
 		flkeys = &_flkeys;
@@ -2309,6 +2316,8 @@ static int ip_route_input_slow(struct sk
 	}
 
 	err = fib_lookup(net, &fl4, res, 0);
+	fl4.flowi4_iif = dev->ifindex;
+	fl4.saddr = saddr;
 	if (err != 0) {
 		if (!IN_DEV_FORWARD(in_dev))
 			err = -EHOSTUNREACH;
@@ -2341,12 +2350,14 @@ static int ip_route_input_slow(struct sk
 
 make_route:
 	err = ip_mkroute_input(skb, res, &fl4, in_dev, daddr, saddr, tos,
-			       flkeys);
+			       flkeys, lsrc);
 out:	return err;
 
 brd_input:
 	if (skb->protocol != htons(ETH_P_IP))
 		goto e_inval;
+	if (lsrc)
+		goto e_inval;
 
 	if (!ipv4_is_zeronet(saddr)) {
 		err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
@@ -2457,9 +2468,26 @@ int ip_route_input_noref(struct sk_buff
 }
 EXPORT_SYMBOL(ip_route_input_noref);
 
+int ip_route_input_lookup(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+			  u8 tos, struct net_device *dev, __be32 lsrc)
+{
+	struct fib_result res;
+	int err;
+
+	tos &= IPTOS_RT_MASK;
+	rcu_read_lock();
+	err = ip_route_input_common_rcu(skb, daddr, saddr, tos, dev, lsrc,
+					&res);
+	rcu_read_unlock();
+
+	return err;
+}
+EXPORT_SYMBOL(ip_route_input_lookup);
+
 /* called with rcu_read_lock held */
-int ip_route_input_rcu(struct sk_buff *skb, __be32 daddr, __be32 saddr,
-		       u8 tos, struct net_device *dev, struct fib_result *res)
+int ip_route_input_common_rcu(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+			      u8 tos, struct net_device *dev, __be32 lsrc,
+			      struct fib_result *res)
 {
 	/* Multicast recognition logic is moved from route cache to here.
 	 * The problem was that too many Ethernet cards have broken/missing
@@ -2505,7 +2533,13 @@ int ip_route_input_rcu(struct sk_buff *s
 		return err;
 	}
 
-	return ip_route_input_slow(skb, daddr, saddr, tos, dev, res);
+	return ip_route_input_slow(skb, daddr, saddr, tos, dev, lsrc, res);
+}
+
+int ip_route_input_rcu(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+		       u8 tos, struct net_device *dev, struct fib_result *res)
+{
+	return ip_route_input_common_rcu(skb, daddr, saddr, tos, dev, 0, res);
 }
 
 /* called with rcu_read_lock() */
@@ -2756,6 +2790,7 @@ struct rtable *ip_route_output_key_hash_
 			fl4->daddr = fl4->saddr = htonl(INADDR_LOOPBACK);
 		dev_out = net->loopback_dev;
 		fl4->flowi4_oif = LOOPBACK_IFINDEX;
+		fl4->fl4_gw = 0;
 		res->type = RTN_LOCAL;
 		flags |= RTCF_LOCAL;
 		goto make_route;
@@ -2813,6 +2848,7 @@ struct rtable *ip_route_output_key_hash_
 		orig_oif = FIB_RES_OIF(*res);
 
 		fl4->flowi4_oif = dev_out->ifindex;
+		fl4->fl4_gw = 0;
 		flags |= RTCF_LOCAL;
 		goto make_route;
 	}
diff -urp v5.18-before-nf_reroute/linux/net/netfilter/nf_nat_core.c linux/net/netfilter/nf_nat_core.c
--- v5.18-before-nf_reroute/linux/net/netfilter/nf_nat_core.c	2022-06-12 16:53:10.000000000 +0300
+++ linux/net/netfilter/nf_nat_core.c	2022-06-12 17:08:19.425321794 +0300
@@ -1125,6 +1125,49 @@ static const struct nf_nat_hook nat_hook
 	.remove_nat_bysrc	= nf_nat_cleanup_conntrack,
 };
 
+unsigned int ip_nat_route_input(void *priv,
+				struct sk_buff *skb,
+				const struct nf_hook_state *state)
+{
+	struct iphdr *iph;
+	struct nf_conn *conn;
+	enum ip_conntrack_info ctinfo;
+	enum ip_conntrack_dir dir;
+	unsigned long statusbit;
+	__be32 saddr;
+
+	if (!(conn = nf_ct_get(skb, &ctinfo)))
+		return NF_ACCEPT;
+
+	if (!(conn->status & IPS_NAT_DONE_MASK))
+		return NF_ACCEPT;
+	dir = CTINFO2DIR(ctinfo);
+	statusbit = IPS_SRC_NAT;
+	if (dir == IP_CT_DIR_REPLY)
+		statusbit ^= IPS_NAT_MASK;
+	if (!(conn->status & statusbit))
+		return NF_ACCEPT;
+
+	if (skb_dst(skb))
+		return NF_ACCEPT;
+
+	if (skb->len < sizeof(struct iphdr))
+		return NF_ACCEPT;
+
+	/* use daddr in other direction as masquerade address (lsrc) */
+	iph = ip_hdr(skb);
+	saddr = conn->tuplehash[!dir].tuple.dst.u3.ip;
+	if (saddr == iph->saddr)
+		return NF_ACCEPT;
+
+	if (ip_route_input_lookup(skb, iph->daddr, iph->saddr, iph->tos,
+	    skb->dev, saddr))
+		return NF_DROP;
+
+	return NF_ACCEPT;
+}
+EXPORT_SYMBOL_GPL(ip_nat_route_input);
+
 static int __init nf_nat_init(void)
 {
 	int ret, i;
diff -urp v5.18-before-nf_reroute/linux/net/netfilter/nf_nat_masquerade.c linux/net/netfilter/nf_nat_masquerade.c
--- v5.18-before-nf_reroute/linux/net/netfilter/nf_nat_masquerade.c	2022-06-12 16:53:10.000000000 +0300
+++ linux/net/netfilter/nf_nat_masquerade.c	2022-06-12 17:08:19.426321782 +0300
@@ -33,8 +33,8 @@ nf_nat_masquerade_ipv4(struct sk_buff *s
 	struct nf_conn_nat *nat;
 	enum ip_conntrack_info ctinfo;
 	struct nf_nat_range2 newrange;
-	const struct rtable *rt;
-	__be32 newsrc, nh;
+	struct rtable *rt;
+	__be32 newsrc;
 
 	WARN_ON(hooknum != NF_INET_POST_ROUTING);
 
@@ -49,12 +49,23 @@ nf_nat_masquerade_ipv4(struct sk_buff *s
 	if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip == 0)
 		return NF_ACCEPT;
 
-	rt = skb_rtable(skb);
-	nh = rt_nexthop(rt, ip_hdr(skb)->daddr);
-	newsrc = inet_select_addr(out, nh, RT_SCOPE_UNIVERSE);
-	if (!newsrc) {
-		pr_info("%s ate my IP address\n", out->name);
-		return NF_DROP;
+	{
+		struct flowi4 fl4 = { .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
+				      .flowi4_mark = skb->mark,
+				      .flowi4_oif = out->ifindex,
+				      .daddr = ip_hdr(skb)->daddr,
+				      .fl4_gw = skb_rtable(skb)->rt_gw4 };
+		rt = ip_route_output_key(dev_net(out), &fl4);
+		if (IS_ERR(rt)) {
+			/* Funky routing can do this. */
+			if (net_ratelimit())
+				pr_info("%s:"
+				       " No route: Rusty's brain broke!\n",
+				       out->name);
+			return NF_DROP;
+		}
+		newsrc = fl4.saddr;
+		ip_rt_put(rt);
 	}
 
 	nat = nf_ct_nat_ext_add(ct);
