Re: icmp forward

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Hinko Kocevar a écrit :
> Christoph Paasch wrote:
>>
>> On Fri January 30 2009, Hinko Kocevar wrote:
>>>
>>> Is it possible to 'port forward' ICMP requests?
>>
>> You can match the protocol on ICMP packets with -p icmp and let the port-
>> specific stuff out of it, as ICMP doesn't uses portnumbers. But the problem will 
>> be, that your external machine won't be reachable for icmp packets. (as every 
>> icmp packets will get forwarded) It may be ennoying if MTU or ping packets 
>> doesn't reach anymore your machine. That depends on the usage of your gateway.
> 
> Yes, that is what I was afraid of. I think that gateway should still remain
> available for ICMP echo-reply from external network.

You must not be afraid of redirecting incoming ICMP replies or error 
messages originally destined to the gateway to the mobile device. These 
messages have the state ESTABLISHED or RELATED, while NAT rules see only 
packets creating a new "connection", which have the state NEW. Even 
though, you could have your DNAT rule match only the echo-request type 
with the --icmp-type option. However, if you redirect ICMP echo request 
to the device, indeed you cannot ping the gateway any more on the same 
external address. You need a separate address.