From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753092AbbHGNAo (ORCPT ); Fri, 7 Aug 2015 09:00:44 -0400 Received: from vps01.wiesinger.com ([46.36.37.179]:38482 "EHLO vps01.wiesinger.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752370AbbHGNAn (ORCPT ); Fri, 7 Aug 2015 09:00:43 -0400 Subject: Re: IPv6 and private net with masquerading not working correctly To: linux-kernel@vger.kernel.org References: <55C3AAE1.3080003@wiesinger.com> From: Gerhard Wiesinger Message-ID: <55C4ABF6.3080407@wiesinger.com> Date: Fri, 7 Aug 2015 15:00:38 +0200 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.1.0 MIME-Version: 1.0 In-Reply-To: <55C3AAE1.3080003@wiesinger.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 06.08.2015 20:43, Gerhard Wiesinger wrote: > Hello, > > I'm having the following problem with IPv6 and a private internal LAN > which will be masqueraded to the public internet (I don't want to have > public IPs in the LAN because of some static IPs and tracking) . Rules > are generated by shorewall. > > Problem is that ICMP6 packets source address is not translated by the > kernel on the reply when MTU has to be discovered because of too big > packets and limited MTU capabilities on the path (happens also on tcp6 > which works thereofore not correctly). > > # From an internal host on net fd00:1234:5678::/64 > ping6 -s 2000 2a02:1234:5678:7::2 > > /etc/shorewall6/masq > EXT_IF fc00::/7 > > ip6tables rule: > MASQUERADE all * * fc00::/7 ::/0 > > # Internal interface > IP6 fd00:1234:5678::9 > 2a02:1234:5678:7::2: frag (0|1432) ICMP6, echo > request, seq 1, length 1432 > IP6 fd00:1234:5678::9 > 2a02:1234:5678:7::2: frag (1432|576) > IP6 2a02:1234:5678:9abc::115 > fd00:1234:5678::9: ICMP6, packet too > big, mtu 1440, length 1240 > > # External interface > IP6 2001:1234:5678:9abc::1 > 2a02:1234:5678:7::2: frag (0|1432) ICMP6, > echo request, seq 1, length 1432 > IP6 2001:1234:5678:9abc::1 > 2a02:1234:5678:7::2: frag (1432|576) > IP6 2a02:1234:5678:9abc::115 > 2001:1234:5678:9abc::1: ICMP6, packet > too big, mtu 1440, length 1240 > > Looks to me like a a major kernel bug. > Kernel version is: 4.1.3-201.fc22.x86_64 from Fedora 22 > > Any ideas? > Any comments? Ciao, Gerhard -- http://www.wiesinger.com/