From mboxrd@z Thu Jan 1 00:00:00 1970 From: Fabien LE BLEVEC Subject: Re: NAT Host down and ICMP host unreachable Date: Fri, 02 Jan 2004 16:53:27 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <3FF593F7.5040600@nerim.net> References: <20031223063726.83624.qmail@web13421.mail.yahoo.com> <200401021325.09089.Antony@Soft-Solutions.co.uk> Reply-To: fleblevec@nerim.net Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200401021325.09089.Antony@Soft-Solutions.co.uk> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/html; charset="us-ascii" Cc: netfilter@lists.netfilter.org

Antony Stone a écrit :

On Tuesday 23 December 2003 6:37 am, JC wrote:

Hello Everybody,

I apologize if you've seen something like this but
searching on something similar to the subject line
above has turned up nill.

Scenario

HostA ------> FW/NAT -----(port translation) --->
HOSTB
(10.10.1.1)
(192.168.7.1)

Rules:
iptables -A PREROUTING -t nat -p tcp --dport 80 -j
DNAT --to 192.168.7.1:80
iptables -A FORWARD -p tcp -d 192.168.7.1 --dport 80
-j ACCEPT

So everything works, but when HostB goes down for
maintence or from a DOS or whatevever FW/NAT will send
an ICMP host unreachable with the natted address to
HostA.

I suppose I'm correct in perceiving that this behavior
is normal, so I'll have to ask how do some of you
people go about dealing with situations such as these?


I don't understand the question.

If host B is down, then "host unreachable" is quite correct.

Yes of course !

What behaviour would you expect, and what problem do you have with what 
happens at present?

But, the data contains in the ICMP host unreachable messages have the natted IP ....

Antony.

Fabien