Re: nat drop the icmp redirect packet

[Patrick McHardy <kaber@trash.net>]

On 11/28/2011 02:12 AM, Gao feng wrote:
> Hi
>
> In func nf_nat_icmp_reply_translation,the icmp packet will be droped when the nat is not finished.
> pc A(whose gateway is C) send a icmp request to pc B.
> When gw C receive this packet,it may return a icmp redirect packet to A.
> BUT now,the icmp request packet has not go to POSTROUTING,So the nat is not finished.
> Finally,the icmp redirect packet will be droped no matter the conn has nat or not.
>
> of course,the icmp redirect packet will be correct handled when nat is finished.
>
> Can somebody will give me some suggestion,
> or should I just add a sysctl to let the user decide drop or receive this icmp redirect packet when nat is not finished?

It doesn't matter whether the ICMP packet has gone through
POST_ROUTING, the conntrack associated with the packet is
that of the original packet causing the ICMP REDIRECT (or
any other kind of ICMP error).

Basically, we don't want hosts talking directly to each other
*if* NAT has been set up since that would obviously break
things. In the case you describe (only destination NAT setup
completed, but null mapping) instead of dropping the packet,
we could set up a null source mapping and let the packet
through under the assumption that the hosts will then start
communicating directly.

This will break if the host receiving the ICMP REDIRECT ignores
it though. What is the specific problem you're trying to solve?