ICMP fragmentation needed packets lost

ICMP fragmentation needed packets lost

[bossk]

Hi,

I have the following setup

-------           ----------------                     -----------------            -------------           ----------------
| B   |--------| VPN-GW2 |=======|  VPN-GW1 | --------|   GW      |--------|       A        |
-------          -----------------                     ------------------           -------------           ---------------- 

The server GW is in the same net (10.0.1.0/28) as VPN-GW via interface bond0 and connected to the same network (10.0.3.0/24) as server A with interface bond2.
Server A can send packets to server B which can be reached through the VPN.

Now the tricky part if server A sends a packet with a size of 1460 Bytes the VPN-GW1 sends an ICMP fragmentation-needed packet to A which
is not passing the GW, if the FORWARD policy is set to DROP.

I have enabled the following rules
iptables -A FORWARD -i bond0 -o bond2 -j ACCEPT
iptables -A FORWARD -i bond2 -o bond0 -j ACCEPT

and specials rules 
iptables -A FORWARD -s 10.0.1.0/28 -d 10.0.3.0/24 -j ACCEPT
iptables -A FORWARD -s 10.0.3.0/24 -d 10.0.1.0/28 -j ACCEPT

If I set the FORWARD policy to ACCEPT then the ICMP fragmentation-needed packet is passing the GW. After I change the FORWARD policy to DROP
that packet is not passing the GW.

Has someone an idea why this happens?

Thanks,
bossk

Re: ICMP fragmentation needed packets lost

[Martijn Lievaart]

bossk wrote:
> Hi,
>
> I have the following setup
>
> -------           ----------------                     -----------------            -------------           ----------------
> | B   |--------| VPN-GW2 |=======|  VPN-GW1 | --------|   GW      |--------|       A        |
> -------          -----------------                     ------------------           -------------           ---------------- 
>
> The server GW is in the same net (10.0.1.0/28) as VPN-GW via interface bond0 and connected to the same network (10.0.3.0/24) as server A with interface bond2.
> Server A can send packets to server B which can be reached through the VPN.
>
> Now the tricky part if server A sends a packet with a size of 1460 Bytes the VPN-GW1 sends an ICMP fragmentation-needed packet to A which
> is not passing the GW, if the FORWARD policy is set to DROP.
>
> I have enabled the following rules
> iptables -A FORWARD -i bond0 -o bond2 -j ACCEPT
> iptables -A FORWARD -i bond2 -o bond0 -j ACCEPT
>
> and specials rules 
> iptables -A FORWARD -s 10.0.1.0/28 -d 10.0.3.0/24 -j ACCEPT
> iptables -A FORWARD -s 10.0.3.0/24 -d 10.0.1.0/28 -j ACCEPT
>
> If I set the FORWARD policy to ACCEPT then the ICMP fragmentation-needed packet is passing the GW. After I change the FORWARD policy to DROP
> that packet is not passing the GW.
>
> Has someone an idea why this happens?
>   

Just a guess, but has VPN-GW1 an IP not in those ranges? Then the icmp 
errors have a different source address and are logically dropped. Adding 
a rule allowing RELATED traffic in should do the tric, or if you don't 
use conntrack, create an explicit rule for these packets.

HTH,
M4