Recently we had the following problem:
when a connection is established from a client on the same network segment (subnet) of the outbound i/f of sbg to the inbound i/f the responce is coming out from the outbound i/f using the ip addr of the inbound i/f. This is a known linux problem called 'ARP Flux", and the source is that " The kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but it usually makes sense, because it increases the chance of successful communication. IP addresses are owned by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing, does this behavior cause problems.“
There sould be a way to overcome this by beeing able to control arp_filter, arp_announce and arp_ignore