Netfilter bug ? NAT'ed connections ignore icmp redirect
amilivojevic at pbl.ca
Wed Sep 15 20:18:10 CEST 2004
Henrik Stoerner wrote:
> I have a setup where I use a Linux box with netfilter to forward
> tcp connections between a "client" and a "server.
> The Linux box has a default gateway defined. However, there are
> multiple other routers on the same network, and the default
> gateway router sends ICMP redirects to inform the Linux box
> which router should be used to reach some destination.
Probably a stupid question. But. Why don't you simply define two
static routes on the NAT box pointing to firewall (packets to server)
and routerC (packets to client)? Or let the router do its job of
actually routing packets instead of generating error messages back to
clients (in which case you would really need one router with 5 interfaces).
IMHO, relying on ICMP redirects to create routes for you is inefficient
and error prone. It's kind of asking for trouble.
Aleksandar Milivojevic <amilivojevic at pbl.ca> Pollard Banknote Limited
Systems Administrator 1499 Buffalo Place
Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
More information about the netfilter