[Bug 34] New: Redirecting udp packets to closed port gives bad icmp error

bugzilla-daemon@netfilter.org bugzilla-daemon@netfilter.org
Sat, 01 Feb 2003 20:10:12 +0100


           Summary: Redirecting udp packets to closed port gives bad icmp
           Product: netfilter/iptables
           Version: linux-2.4.x
          Platform: i386
        OS/Version: RedHat Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: ip_tables (kernel)
        AssignedTo: laforge@netfilter.org
        ReportedBy: nfudd-netfilter-org@speed-test.net
                CC: netfilter-buglog@lists.netfilter.org

As there is no way to say 'reject' or 'mark' in the prerouting table of nat, I
use 'redirect' to send unwanted packets to a closed port.

In this example, I've redirected all udp packets except port 53 to port 1.
When a packet comes in for ntp (for example), I expect the icmp error message to
say 'port 111 unreachable', but instead it says 'port 1 unreachable'.  Also, the
icmp error is from the wrong ip address.

Tcpdump output:
11:00:04.833119 >  v4 client strat 0 poll 4
prec -6 (DF)
11:00:04.835416 > icmp: udp port tcpmux
unreachable [tos 0xc0]

( is the client machine, is the iptables firewall, is a time server)

I'm using Redhat 8.0, Linux kernel 2.0.40, patch-o-matic-20030107.tar.bz2, and

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.