Conntrack, failed to NAT its own TCP packets from another VRF
Solution 1:
The issue was present on debian 10 with a kernel 4.19.0-12-amd64, but after an upgrade to debian 11 with a kernel 5.10.0-11-amd64, it works as expected, even for TCP flows.
The issue was present on debian 10 with a kernel 4.19.0-12-amd64, but after an upgrade to debian 11 with a kernel 5.10.0-11-amd64, it works as expected, even for TCP flows.