Re: ICMP traffic + iproute + tunnel problems

[Bart Matthaei <bart@dreamflow.nl>]

On Wed, May 19, 2004 at 10:33:27PM +0100, Antony Stone wrote:
> On Wednesday 19 May 2004 10:11 pm, Bart Matthaei wrote:
> 
> > Hi All,
> >
> > I have the following problem:
> >
> > I have a tunnel between my home router and my colocated machine.
> > I use source routing (iproute) to route all traffic coming from my home
> > network (public ipspace) over the tunnel.
> >
> > Everything works fine. But when a user traceroutes a host in my home
> > network, or sends traffic to an unreachable host, all ICMP replies are
> > coming from the ip address of my cable connection (eth0), which is still
> > the default route on the home router itself.
> 
> I don't see that the result could be any different, since the source of the 
> packets going back to the external address really is your cable connection on 
> eth0 - not an internal address which can be used to match any source-routing 
> rule.
> 
> If someone pings (or telnets, or whatever) an unreachable host on your network 
> (or should that be an unreachable host not on your network...?), then the 
> host itself obviously cannot send back a response - it is the upstream router 
> which does this, and the source address of the response it sends is that of 
> its own external interface.
> 
> Maybe you should block incoming traceroutes (ie don't send back TTL exceeded 
> ICMP responses), and be selective about what other ICMP responses you allow 
> back (such as host / port / network unreachable)?

Ok. So it isn't possible to isolate certain icmp packets (which I already
did with the MARK trick) and send them with an alternative source address?

Cheers,

Bart

-- 
Bart Matthaei                    bart@dreamflow.nl 

Sometimes a cigar is just a cigar.
                -- Sigmund Freud