Re: snat and ICMP question

[Marian Stagarescu <marian@ti.com>]

> I'm using the following configuration
>
> iptables -t mangle -A PREROUTING --in-interface ipsec+ \
>                         -j MARK --set-mark 1
> iptables -t nat -A POSTROUTING -m mark --mark 1 \
>                                 -j MASQUERADE

i think that the icmp packet is not marked hence not masqueraded 
(it is locally generated by the ip stack (above ipsec anyways) hence
does not follow rule 1 mangle above).

is this your config ?

      
                    SNAT
             ------------------->
ipsec-interface         public_interface-------WEB-SERVER
     mtu 1400             mtu 1500
                                       |               1500
                                       |         <-------------      
                                       |                       
        ICMP frag required     |
        (OUTPUT) ------------+

> However the IPsec tunnel had an MTU of 1400, slightly less
> than the ethernet packet. When a user requests a large
> web page (for example), the web server send big packets,
> and an ICMP error is generated by the NAT-ing node. However
> the ICMP packet contains the real destination address, not
> the address of the NAT device... The web server ignores the
> ICMP error, which is normal.
>
> I'm using iptables v1.2.7a with a 2.4.17 kernel. I haven't
> tried anding any additional patches.
>
> Has anybody previously encountered this sort of problem?
> How can I tell iptables to NAT inside ICMP packets that are
> generated locally but that concern connections coming
> from the tunnel? I suppose it would work if I just
> masquraded everything going through any interface,
> but that seems a bit drastic...
>
> Thanks for any pointers,
> Ciaran