Netfilter bug ? NAT'ed connections ignore icmp redirect

[Aleksandar Milivojevic]

Henrik Stoerner wrote:
> I have a setup where I use a Linux box with netfilter to forward
> tcp connections between a "client" and a "server.
> 
> The Linux box has a default gateway defined. However, there are
> multiple other routers on the same network, and the default
> gateway router sends ICMP redirects to inform the Linux box 
> which router should be used to reach some destination.

Probably a stupid question.  But.  Why don't you simply define two 
static routes on the NAT box pointing to firewall (packets to server) 
and routerC (packets to client)?  Or let the router do its job of 
actually routing packets instead of generating error messages back to 
clients (in which case you would really need one router with 5 interfaces).

IMHO, relying on ICMP redirects to create routes for you is inefficient 
and error prone.  It's kind of asking for trouble.

-- 
Aleksandar Milivojevic <amilivojevic at pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7