ICMP Connections ...

[Aleksandar Milivojevic]

Chetan Nagaraja wrote:
> To ping a host in a different network, I have configured a dual homed[ 
> two network interfaces] linux system to act as NAT router.

[snip]

> But I'am unable to understand the fact that the ICMP replies are 
> reaching the host in NETWORK A which had generated the requests, without 
> adding a DNAT rule for the same.
> How is this possible, does iptables automatically redirect ICMP replies ?
> And How to avoid the same.

Yes, you specify that you want to do SNAT or DNAT in one direction, and 
Netfilter will handle returning packets (and only returning packets!) 
correctly.

BTW, what would be the purpuse of preventing this???  If the returned 
packet wasn't handled automatically, neither the firewall nor the host 
in network A would be able to handle it.  Firewall wouldn't be able to 
handle it since original ping request hasn't originated from it.  Host 
in network A (if packet managed to miraculasly reach it despite of 
incorrect destination IP address) wouldn't be able to handle it (other 
than forwarding it back to the firewall, if kernel configuration 
permits) since reply would have destination IP address of the firewall 
in the headers.  So really no point in avoiding this behaviour.

-- 
Aleksandar Milivojevic <amilivojevic at pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7