From: Gao feng <gaofeng@cn.fujitsu.com>
To: netfilter-devel@vger.kernel.org
Subject: Re: nat drop the icmp redirect packet
Date: Mon, 28 Nov 2011 09:23:48 +0800 [thread overview]
Message-ID: <4ED2E2A4.6000505@cn.fujitsu.com> (raw)
In-Reply-To: <4ED2E00B.3000006@cn.fujitsu.com>
于 2011年11月28日 09:12, Gao feng 写道:
> Hi
>
> In func nf_nat_icmp_reply_translation,the icmp packet will be droped when the nat is not finished.
> pc A(whose gateway is C) send a icmp request to pc B.
> When gw C receive this packet,it may return a icmp redirect packet to A.
> BUT now,the icmp request packet has not go to POSTROUTING,So the nat is not finished.
> Finally,the icmp redirect packet will be droped no matter the conn has nat or not.
>
> of course,the icmp redirect packet will be correct handled when nat is finished.
>
> Can somebody will give me some suggestion,
> or should I just add a sysctl to let the user decide drop or receive this icmp redirect packet when nat is not finished?
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
or maybe we can move the ip_rt_send_redirect from FORWARD to POSTROUTING?
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2011-11-28 1:23 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-11-28 1:12 nat drop the icmp redirect packet Gao feng
2011-11-28 1:23 ` Gao feng [this message]
2011-11-30 4:00 ` Gao feng
2011-11-30 18:53 ` Patrick McHardy
2011-12-01 0:59 ` Gao feng
2011-12-01 10:20 ` Patrick McHardy
2011-12-02 5:32 ` Gao feng
2011-12-02 12:58 ` Patrick McHardy
2011-12-05 1:18 ` Gao feng
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4ED2E2A4.6000505@cn.fujitsu.com \
--to=gaofeng@cn.fujitsu.com \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).