Conntrack & ICMP host unreachable bug ??

Conntrack & ICMP host unreachable bug ??

[Fabien LE BLEVEC]

Hello !

I want to have your point of view about this log :

Dec 30 17:20:52 fw kernel: fw_net
IN= OUT=ppp0 SRC=62.xx.xx.xx DST=207.46.106.115
LEN=68 TOS=0x00 PREC=0xC0 TTL=3 ID=2336
PROTO=ICMP TYPE=3 CODE=1
[SRC=207.46.106.115 DST=192.168.0.10
LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=6714
PROTO=TCP SPT=1863 DPT=1033
SEQ=258256682 ACK=3649636442 WINDOW=16805 RES=0x00 ACK FIN URGP=0 ]


The firewall box wanted to transmit this packet (ICMP host unreachble) 
because I changed the IP address of the computer 192.168.0.10 to 
192.168.0.34. During this change, there was an entry in the ip_conntrack 
table for this connection... and so it is normal that the firewall 
wanted to do this !
But, If you see the data in the ICMP messages, you can see that he 
didn't translate the source address ...

He have the behavior of a router but not a "NAT router", I think he 
should not reply to this problem, and just remove the entry on the 
conntrack tables whithout sending anythings !


Of course I have this rules (and others):
iptables -t nat -A POSTROUTING -o ppp0 -j SNAT --to 62.xx.xx.xx

Can it be a bug like the ICMP DNAT (2002-05-08) ?



Best regard.

Fabien