Messages in log with SNAT target

Sietse van Zanen sietse at
Mon Jul 24 12:49:32 CEST 2006

It's NOT default behaviour of NT to drop ICMP Redirects.
It IS default behaviour not to accept gateways, that are not on the local subnet. 
This should count for UNIX too, I think.


From: netfilter-bounces at on behalf of Pascal Hambourg
Sent: Mon 24-Jul-06 12:24
To: netfilter at
Subject: Re: Messages in log with SNAT target


Anssi Hannula a écrit :
> I've been using this kind of configuration on my Linux router for a few
> years:
> eth0, public internet ip
> eth0:0, private network ip

You know that having both internet and a private LAN on the same
interface is a *very* bad idea, don't you ? I suppose you have no other

> IP forwarding enabled.
> And a rule for iptables:
> -A POSTROUTING -s -d ! -j
> SNAT --to-source
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
>   U     10     0        0 eth0
>   U     10     0        0 eth0
>         UG    10     0        0 eth0
> However, I get lots of this kind of messages in the dmesg while routing:
> host ignores redirects for to
[and so on]

Here's what happens. On your router box, all routes use the same
interface eth0, so when it receives a packet for another destination
than the box itself, it sends an "ICMP Redirect" message to the source
IP address meaning "hey, there is a more direct route to destination
70.35.x.x using gateway instead of me. Please update your
routing table".

Happily, the host ignores the "ICMP Redirect" messages. One
reason is I think that's a default behaviour of Windows NT. Another
reason is that host has probably no direct route to the proposed gateway
address. Anyway, if it didn't ignore the "ICMP Redirect", it would
probably lose connectivity with internet hosts because of its private

Note : destination NAT (DNAT) on the same network blocks the sending of
"ICMP Redirect" messages by the routing decision, because destination
NAT takes place before the routing decision. But source NAT (SNAT,
MASQUERADE) doesn't, because it takes place after the routing decision,
so it's too late (see Netfilter diagram in

You can enable or disable the sending of "ICMP Redirect" messages with
the kernel parameter send_redirect.

send_redirects - BOOLEAN
      Send redirects, if router.
      send_redirects for the interface will be enabled if at least one of
      conf/{all,interface}/send_redirects is set to TRUE,
      it will be disabled otherwise
      Default: TRUE

To disable sending "ICMP redirect" on eth0 :

echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects

or :

sysctl -w net/ipv4/conf/all/send_redirects=0
sysctl -w net/ipv4/conf/eth0/send_redirects=0

More information about the netfilter mailing list