diff --git a/kernel-module/nft_rtpengine.c b/kernel-module/nft_rtpengine.c
index 6ad67df64..e273e59aa 100644
--- a/kernel-module/nft_rtpengine.c
+++ b/kernel-module/nft_rtpengine.c
@@ -5571,6 +5571,11 @@ static int send_proxy_packet(struct sk_buff *skb, const struct re_address *src,
 		goto drop;
 	}
 
+	/* This skb was received from the network but is now being reinjected as
+	 * a new locally generated packet. Drop inherited routing, conntrack, and
+	 * netfilter metadata before handing it to the IP output path. */
+	skb_scrub_packet(skb, true);
+
 	switch (src->family) {
 		case AF_INET:
 			return send_proxy_packet4(skb, src, dst, tos, net);