From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bart Matthaei Subject: Re: ICMP traffic + iproute + tunnel problems Date: Thu, 20 May 2004 00:03:42 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20040519220342.GA28055@dreamflow.nl> References: <20040519211105.GH1003@dreamflow.nl> <200405192233.27254.Antony@Soft-Solutions.co.uk> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <200405192233.27254.Antony@Soft-Solutions.co.uk> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@lists.netfilter.org On Wed, May 19, 2004 at 10:33:27PM +0100, Antony Stone wrote: > On Wednesday 19 May 2004 10:11 pm, Bart Matthaei wrote: > > > Hi All, > > > > I have the following problem: > > > > I have a tunnel between my home router and my colocated machine. > > I use source routing (iproute) to route all traffic coming from my home > > network (public ipspace) over the tunnel. > > > > Everything works fine. But when a user traceroutes a host in my home > > network, or sends traffic to an unreachable host, all ICMP replies are > > coming from the ip address of my cable connection (eth0), which is still > > the default route on the home router itself. > > I don't see that the result could be any different, since the source of the > packets going back to the external address really is your cable connection on > eth0 - not an internal address which can be used to match any source-routing > rule. > > If someone pings (or telnets, or whatever) an unreachable host on your network > (or should that be an unreachable host not on your network...?), then the > host itself obviously cannot send back a response - it is the upstream router > which does this, and the source address of the response it sends is that of > its own external interface. > > Maybe you should block incoming traceroutes (ie don't send back TTL exceeded > ICMP responses), and be selective about what other ICMP responses you allow > back (such as host / port / network unreachable)? Ok. So it isn't possible to isolate certain icmp packets (which I already did with the MARK trick) and send them with an alternative source address? Cheers, Bart -- Bart Matthaei bart@dreamflow.nl Sometimes a cigar is just a cigar. -- Sigmund Freud