I can reproduce with firewall_driver=iptables_hybrid and dvr. I attached a patch that directs only packets from the gateway to the vm ports. All other packets from tunnels will hit the NORMAL flow in table 60.
Without patch:
table=60, priority=20,dl_vlan=1,dl_dst=fa:16:3e:5b:72:d8 actions=strip_vlan,output:"qvod638e8da-88"
table=60, priority=3 actions=NORMAL
With patch (gateway_mac is fa:16:3e:f1:f3:06):
table=60, priority=20,dl_vlan=1,dl_src=fa:16:3e:f1:f3:06,dl_dst=fa:16:3e:5b:72:d8 actions=strip_vlan,output:"qvod638e8da-88"
table=60, priority=3 actions=NORMAL
I can reproduce with firewall_ driver= iptables_ hybrid and dvr. I attached a patch that directs only packets from the gateway to the vm ports. All other packets from tunnels will hit the NORMAL flow in table 60.
Without patch: 20,dl_vlan= 1,dl_dst= fa:16:3e: 5b:72:d8 actions= strip_vlan, output: "qvod638e8da- 88"
table=60, priority=
table=60, priority=3 actions=NORMAL
With patch (gateway_mac is fa:16:3e:f1:f3:06): 20,dl_vlan= 1,dl_src= fa:16:3e: f1:f3:06, dl_dst= fa:16:3e: 5b:72:d8 actions= strip_vlan, output: "qvod638e8da- 88"
table=60, priority=
table=60, priority=3 actions=NORMAL
@sondx25 - can you try this patch?