Is it safe to pass the same traffic through the same router twice and then have connection tracking firewalling on both passes?
Will the two filtering places have separate connection tracking, and if not, will the two passes through the connection tracking firewall
interfere with each other?
Case: a CCR is routing between ether1-4 (2 vlans) and ether8 (2 vlans), and there is the usual connection tracking firewall.
On the same CCR, ether5-7 are bridged. Ether7 is connected to internet and 5 and 7 to systems with 2 network cards,
the other card of those systems is on ether1 and ether3.
The systems are taking internet traffic and partly routing it to the ether1 and ether3 ports on a vlan, where it is routed further
towards the other vlans on ether1-4 and ether8. This works.
Now, if I would enable IP firewalling on the bridge, the same traffic would first be seen by the router passing from ether7
to ether 5/6, then it would re-enter the router at ether1/3 and be routed. All without NAT.
Of course I would have some separate tables that are selected by the input bridge port or input interface to filter it in different ways.
Is that possible? Or will there be problems because the same connection is seen twice, once on the bridge and once when routing?