Re: icmp-redirect

[Grant Taylor <gtaylor@riverviewtech.net>]

On 07/15/08 15:25, Andrea Bencini wrote:
> I have a local network (10.100.0.0/24) and my default gateway is a 
> firewall (fw;eth0=10.100.0.1) with linux OS and netfilter.
> In the same network I have an other gateway (linux OS and netfilter) to 
> connect a local subnetwork (10.6.70.0/24). Gateway eth0 is 10.100.0.241 
> and gateway eth1 is 10.6.70.241.
> In the local network (10.100.0.0/24) I have windows client (XP prof) and 
> default gateway of these is 10.100.0.1.
> I want implement "icmp redirect" in the firewall (default gateway); What 
> do I have to add or to change in my firewall?

Are you sure that it is not happening already?  There are some /proc 
entries controlling how Linux behaves regarding ICMP redirects (should 
it listen to and / or send them) that you can change.  I think they both 
are enabled by default, though your distro may throb them.

/proc/sys/net/ipv4/icmp_ratemask
/proc/sys/net/ipv4/icmp_ratelimit
/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
/proc/sys/net/ipv4/icmp_echo_ignore_all

I think you will be most interested in the last two.  Check kernel 
documentation (<kernel source>/Documentation/networking/ip-sysctl.txt) 
for more information.



Grant. . . .