terminating connections when an interface goes down

terminating connections when an interface goes down

[MaXxX]

Hello.

Having recently switched to a faster ISP but with dynamically assigned
(and forcibly changed every 24h) IP, I'd like the conntrack module to
TERMINATE all active connections when the IP changes. Some programs
behave very badly when their connections are left to time out.

So far I've been using the MASQUERADE target, but all the difference
between it and SNAT is that it forgets its connections. What I'd like
is that it terminated them (immediate RST to all connections).

Is there an option I can use for that, or should I go try to make a
patch for it (if so, then what source file should I be mostly looking
at?)

-- 
 |\  /|      \~~~/     \~~~/
 | \/ |  /\   > <  \~/  > <    ICQ# 3146019
 |____| /__\ /___\ /_\ /___\    IQ# 3.14159
"This is Pearl Harbor! Japanese aircraft incom-" NO CARRIER

terminating connections when an interface goes down

[MaXxX]

Hello.

Having recently switched to a faster ISP but with dynamically assigned
(and forcibly changed every 24h) IP, I'd like the conntrack module to
TERMINATE all active connections when the IP changes. Some programs
behave very badly when their connections are left to time out, and
some services ban a user for quite a long time when they detect a
double login (and that's how a timeout-IP change-relogin looks to
them)...

So far I've been using the MASQUERADE target, but all the difference
between it and SNAT is that it forgets its connections. What I'd like
is that it terminated them - preferably by generating a two-way
FIN+RST (or whatever a "terminate" packet looks like).

Is there an option I can use for that, or should I try to make a patch
for it (if so, what source file should I be mostly looking at?)

-- 
 |\  /|      \~~~/     \~~~/
 | \/ |  /\   > <  \~/  > <    ICQ# 3146019
 |____| /__\ /___\ /_\ /___\    IQ# 3.14159
"This is Pearl Harbor! Japanese aircraft incom-" NO CARRIER

Re: terminating connections when an interface goes down

[Antony Stone]

On Saturday 13 March 2004 6:24 pm, MaXxX wrote:

> Hello.
>
> Having recently switched to a faster ISP but with dynamically assigned
> (and forcibly changed every 24h) IP, I'd like the conntrack module to
> TERMINATE all active connections when the IP changes.
>
> So far I've been using the MASQUERADE target, but all the difference
> between it and SNAT is that it forgets its connections. What I'd like
> is that it terminated them - preferably by generating a two-way
> FIN+RST (or whatever a "terminate" packet looks like).

My recommendation is to use a utility quite independently of netfilter, which 
gets called when your IP address changes (the dhcpcd-eth0.exe script would be 
a good place to do this), and simply sends a suitable RST packet to each 
connection found in /proc/net/ip_conntrack at the time it is called.   
Netfilter will then sort itself out and remove the connection tracking table 
entries when it sees the RST packets.

I'm sure you can find a ready-made utility for generating such RST packets 
(they have to contain the right sequence number) if you don't want to do your 
own coding.

If you still want to try building this into netfilter, I suggest you ask on 
the developers' list instead of the users' list.

Regards,

Antony.

-- 
I want to build a machine that will be proud of me.

 - Danny Hillis, creator of The Connection Machine

                                                     Please reply to the list;
                                                           please don't CC me.