From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan B db@cyclonehq.dnsalias.net Date: Thu, 15 Feb 2001 04:44:30 +0000 Subject: Preventing ICMP Redirects? (was: Re: [LARTC] HTTP only Message-Id: List-Id: References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org 
At 02:36 AM 2/11/2001 -0200, Rogerio Brito wrote:
>On Feb 10 2001, bert hubert wrote:
> > You can, I think, but you need to be very sure that your NAT machine
> > isn't sending out any ICMP Redirects.
>
>         I've been bitten by these ICMP Redirects once. Is there any
>         way to prevent them from being sent out? Perhaps doing some
>         packet filtering of the ICMP Redirects? Even if this works,
>         this sure sounds like a dirty solution... :-(
>
>         In that occasion, I was trying to set up a masquerading box
>         with only one NIC and two IP addresses (the Internet-valid one
>         and the private one), hooking everything in a single hub and
>         routing accordingly.
>
>         I don't remember the details (since this was many months ago),
>         but the only solution that I could make work was to buy
>         another NIC for the masquerading box and put one IP in each
>         NIC, doing everything as usual. :-(
>
>         As I don't remember more details of the situation, I'm just
>         hoping that this description rings a bell for someone. Any
>         explanation of how to make this setup with just one NIC or
>         comments on why this shouldn't be done are immensely
>         appreciated.

Even when you correctly aliased your single NIC to act like two interfaces?

eth0:0  routable ip / external (seperate) subnet
eth1:1 local ip / local subnet

I've done what you described using aliasing a couple of times and I never 
got bit by ICMP redirects (like I did this last time).

Now I kind of wish I would have fixed the ICMP redirect problem instead of 
just changing subnets.  :-)

Dan Browning, Cyclone Computer Systems, danb@cyclonecomputers.com