Re: Bug? ICMPs sent by REJECT are not getting SNAT'd...

[Taner Halicioglu <taner@taner.net>]

Uh, ok... I solved this comepletely outside of iptables :-)

 ip route change default via 10.1.1.1 dev eth1 src 200.1.1.1

works like a charm, and I got rid of my SNAT:

 iptables -t nat -A POSTROUTING -o eth1 -s 10.1.1.1 -j SNAT --to-source 200.1.1.1

(no more need for that ;)

	-Taner

On Fri, Apr 11, 2003 at 12:08:05PM -0700, Taner Halicioglu <taner@taner.net> wrote:

> On Fri, Apr 11, 2003 at 08:58:00PM +0200, Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> wrote:
> 
> > > No, the problem is that when the firewall machine REJECTs any packets in a
> > > FORWARD chain (ie, anything I am blocking that is destined to the network
> > > behind it), the source IP of the ICMP UNREACH (or evn the RST packets) is
> > > that of the *outside* interface - the unroutable address.  It seems the
> > > POSTROUTING is not performed on the ICMPs that are created by the actual
> > > host.
> > 
> > If this is a problem of the forwarded packets, then it has nothing to do
> > with the connections initiated from/targeted to the firewall itself.
> 
> What?  Of course it does!
> 
> I have a rule like:
> 
>  iptables -A Firewall -p tcp --dport 1434 -j REJECT
> 
> where 'Firewall' is
> 
>  iptables -A FORWARD -i eth1 -j Firewall
> 
> The above rule will generate an ICMPUNREACH if it tries to forward a packet
> coming in eth1 that is destined for port 1434 to anything behind the firewall
> machine.
> 
> This UNREACH is generated with a source IP of my firewalls *outside*
> interface, which is the unrouteable address (and is filtered by my ISP).  I
> need this ICMP to be generated with a source IP of my *inside* interface,
> instead.
> 
> > But if the packets created by the REJECT target contain the address of the
> > firewall, then the packet they are rejecting was targeted to the firewall.
> 
> No, see above.
> 
> > Show me the tcpdump of both the packets rejected and the reject packets
> > generated.
> 
> 12:05:31.037765 66.220.X.Y.38487 > 67.122.A.B.ms-sql-m: S 2857026105:2857026105(0) win 5840 <mss 1460,sackOK,timestamp 406253139 0,nop,wscale 0> (DF) [tos 0x10]
> 12:05:31.037805 10.0.0.1 > 66.220.X.Y: icmp: 67.122.196.121 tcp port ms-sql-m unreachable [tos 0xd0]
> 
> Notice how the source address on the ICMP unreach is the unroutable IP.  I
> need it to be an address on the 67.122.n.n address block (my inside
> interface).
> 
> Refer to my original email w/ diagram again, if you need to :)
> 
> 	-Taner