From: Fabien LE BLEVEC <fleblevec@nerim.net>
To: netfilter@lists.netfilter.org
Subject: Conntrack & ICMP host unreachable bug ??
Date: Tue, 30 Dec 2003 19:28:23 +0100 [thread overview]
Message-ID: <3FF1C3C7.4000401@nerim.net> (raw)
Hello !
I want to have your point of view about this log :
Dec 30 17:20:52 fw kernel: fw_net
IN= OUT=ppp0 SRC=62.xx.xx.xx DST=207.46.106.115
LEN=68 TOS=0x00 PREC=0xC0 TTL=3 ID=2336
PROTO=ICMP TYPE=3 CODE=1
[SRC=207.46.106.115 DST=192.168.0.10
LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=6714
PROTO=TCP SPT=1863 DPT=1033
SEQ=258256682 ACK=3649636442 WINDOW=16805 RES=0x00 ACK FIN URGP=0 ]
The firewall box wanted to transmit this packet (ICMP host unreachble)
because I changed the IP address of the computer 192.168.0.10 to
192.168.0.34. During this change, there was an entry in the ip_conntrack
table for this connection... and so it is normal that the firewall
wanted to do this !
But, If you see the data in the ICMP messages, you can see that he
didn't translate the source address ...
He have the behavior of a router but not a "NAT router", I think he
should not reply to this problem, and just remove the entry on the
conntrack tables whithout sending anythings !
Of course I have this rules (and others):
iptables -t nat -A POSTROUTING -o ppp0 -j SNAT --to 62.xx.xx.xx
Can it be a bug like the ICMP DNAT (2002-05-08) ?
Best regard.
Fabien
reply other threads:[~2003-12-30 18:28 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3FF1C3C7.4000401@nerim.net \
--to=fleblevec@nerim.net \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.