PMTU-D and conntrack

PMTU-D and conntrack

[John A. Sullivan III]

Are the ICMP Destination Unreachable-Fragmentation Needed and DF Set
(type 3, code 4) packets sent in response to a TCP packet doing PMTU
discovery considered RELATED or does one need to allow NEW connections
for such packets?

By the way, is there a way to specify code number in the --icmp-type
match? I think one can do -p 1 --icmp-type fragmentation-needed but I
usually use the numbers to avoid lookups, e.g., -p 1 --icmp-type 8.
Thanks - John
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan@opensourcedevel.com

If you would like to participate in the development of an open source
enterprise class network security management system, please visit
http://iscs.sourceforge.net

Re: PMTU-D and conntrack

[Philip Craig]

On 02/06/2006 03:47 PM, John A. Sullivan III wrote:
> Are the ICMP Destination Unreachable-Fragmentation Needed and DF Set
> (type 3, code 4) packets sent in response to a TCP packet doing PMTU
> discovery considered RELATED or does one need to allow NEW connections
> for such packets?

The man page says that ICMP errors are RELATED, but I seem to recall
them showing up as ESTABLISHED instead.  In any case, fragmentation
needed errors are treated the same as other ICMP errors, and so an
accept ESTABLISHED/RELATED rule is enough.

> By the way, is there a way to specify code number in the --icmp-type
> match? I think one can do -p 1 --icmp-type fragmentation-needed but I
> usually use the numbers to avoid lookups, e.g., -p 1 --icmp-type 8.
> Thanks - John

The man page doesn't mention this, but if you run iptables -p icmp -h
then it says you can use type/code, eg -p 1 --icmp-type 3/4