Thanks for the tip. I was just what I needed to set me on the right track.
The root cause was unfiltered forwarding between lan and public interface.
When the public interface got torn down it cleared the conntrack entries.
The clients then tried to revive their connections and ended up sending out RST and FIN packets.
Since NAT gets setup only on NEW connections, these packets then left the router unmodified.
I had to change my forwarding rule to only allow NEW,ESTABLISHED,RELATED packets to get forwarded from private lan.
can TCP packets arrive to receiver by pieces?
Yes. IP supports fragmentation, though TCP generally tries to determine the path MTU and keep its packets smaller than that for performance reasons. Fragmentation increases the datagram loss rate catastrophically. If a path has a 10% packet loss rate, fragmenting a datagram into two packets makes the datagram loss rate almost 20%. (If either packet is lost, the datagram is lost.)
You don't have to worry about this though, and neither does the TCP layer. The IP layer reassembles packets into whole datagrams.
E.g.: if I send 20 bytes using TCP protocol, can I be 100% sure that I will receive exactly 20 bytes at once, not 10 bytes then another 10 bytes or so?
No, but that has nothing to do with packets. TCP is, fundamentally, a byte stream protocol that does not preserve application message boundaries.
And the same question for UDP protocol. I know that UDP is unreliable and packets can not arrive at all or arrive in different order,
The same is true for TCP. Packets are packets. The difference is that TCP has retries and reordering built into the protocol while UDP does not.
but what about 1 packet? If it arrives, can I be sure that it is a complete packet, not a piece?
No, but that's not your problem. The UDP protocol handles datagram reassembly. That's part of its job. (In actuality, the IP protocol does this for the UDP protocol, so UDP does it merely by being layered on top of IP.) If a datagram gets split over two packets, the IP protocol will reassemble it for the UDP protocol, so you will see the complete data.
Best Answer
If you want to split the incoming network traffic between two local connections, assuming each of your interfaces have a different address, you could do it with dst-nat:
In case what you meant was to split the outgoing traffic between two outside connections, and each of the connections have a different address, you could do it this way: