I have a configuration where UDP packets containing encapsulated DNS data are sent to a KVM instance for processing. The KVM instance sits behind an IPtables firewall which is also doing NAT. The stream is coming in on average at about 25Mb per second.
The stream comes in and works as expected with one exception. If I terminate the KVM instance and remove the IPtables rules, the stream no longer gets forwarded through the IPtables box. I expect this behavior. If I bring up another KVM instance with the same IP address, and add the same rules back into iptables, the stream does not get forwarded until I stop the stream on the sending side and leave it off for at least 30 seconds. If I start the stream after waiting 30 seconds, the traffic is again passed to the KVM instance.
I'm thinking there is some kernel parameter related to UDP timeouts that I'm unaware of. Has anyone seen behavior like this? The IPtables box is running CentOS 6.4. The KVM instance is running Ubuntu 10.04.