From: Dan B db@cyclonehq.dnsalias.net
To: lartc@vger.kernel.org
Subject: Preventing ICMP Redirects? (was: Re: [LARTC] HTTP only
Date: Thu, 15 Feb 2001 04:44:30 +0000 [thread overview]
Message-ID: <marc-lartc-98373940417020@msgid-missing> (raw)
In-Reply-To: <marc-lartc-98373940417007@msgid-missing>
<PRE>At 02:36 AM 2/11/2001 -0200, Rogerio Brito wrote:
><i>On Feb 10 2001, bert hubert wrote:
</I>><i> > You can, I think, but you need to be very sure that your NAT machine
</I>><i> > isn't sending out any ICMP Redirects.
</I>><i>
</I>><i> I've been bitten by these ICMP Redirects once. Is there any
</I>><i> way to prevent them from being sent out? Perhaps doing some
</I>><i> packet filtering of the ICMP Redirects? Even if this works,
</I>><i> this sure sounds like a dirty solution... :-(
</I>><i>
</I>><i> In that occasion, I was trying to set up a masquerading box
</I>><i> with only one NIC and two IP addresses (the Internet-valid one
</I>><i> and the private one), hooking everything in a single hub and
</I>><i> routing accordingly.
</I>><i>
</I>><i> I don't remember the details (since this was many months ago),
</I>><i> but the only solution that I could make work was to buy
</I>><i> another NIC for the masquerading box and put one IP in each
</I>><i> NIC, doing everything as usual. :-(
</I>><i>
</I>><i> As I don't remember more details of the situation, I'm just
</I>><i> hoping that this description rings a bell for someone. Any
</I>><i> explanation of how to make this setup with just one NIC or
</I>><i> comments on why this shouldn't be done are immensely
</I>><i> appreciated.
</I>
Even when you correctly aliased your single NIC to act like two interfaces?
eth0:0 routable ip / external (seperate) subnet
eth1:1 local ip / local subnet
I've done what you described using aliasing a couple of times and I never
got bit by ICMP redirects (like I did this last time).
Now I kind of wish I would have fixed the ICMP redirect problem instead of
just changing subnets. :-)
Dan Browning, Cyclone Computer Systems, <A HREF="mailto:danb@cyclonecomputers.com">danb@cyclonecomputers.com</A>
</PRE>
prev parent reply other threads:[~2001-02-15 4:44 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2001-02-11 4:36 Preventing ICMP Redirects? (was: Re: [LARTC] HTTP only works on second try from doublely NAT'ed wi Rogerio
2001-02-15 4:44 ` Dan [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=marc-lartc-98373940417020@msgid-missing \
--to=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox