From mboxrd@z Thu Jan  1 00:00:00 1970
From: prmarino1@gmail.com
Subject: Re: Configure ICMP error source address
Date: Fri, 08 Jan 2016 10:24:48 -0500
Message-ID: <20160108152448.5251154.50977.21786@gmail.com>
References: <568F8207.9040305@heinlein-support.de>
Mime-Version: 1.0
Content-Transfer-Encoding: QUOTED-PRINTABLE
Return-path: <netdev-owner@vger.kernel.org>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=content-type:mime-version:content-transfer-encoding:message-id:date
         :subject:from:in-reply-to:references:to;
        bh=icu+gbZGRIZ3hD3zTQNz8ZUm4cuH0Q1/DBE+xQkABtc=;
        b=bba3QBecjH80O03SVNwOvZrYOju066DDP20QRiXfeUvgzyrFluQMS63GEN5dQeFfuJ
         OXTdvPZn0AOBzcKHFnCln3+rHj7IkRCcKMbDliHHNrif/cHraNxGZ3au+TRLipRA7rwq
         J7zzzVNKc2Wn5nE9Zk+PKA4tWvmwqAkG2OPpIKhufi5K5hvIuNCTa2nwNjHMjx8iUeAx
         RnwrFfqrmzJsDkbyfShT1PVQjA/icmX91eZRqOT2+Wjt8lkyJa8DouZWxd/lW9AEArXm
         5yJr6dMJ0N03GjkONYuMY+iapKZbYyBuETAq4Ikb5iC2KzZtQQ+jzndD9c8upYeiZCsC
         pXzQ==
In-Reply-To: <568F8207.9040305@heinlein-support.de>
Sender: netdev-owner@vger.kernel.org
List-ID: <netfilter.vger.kernel.org>
Content-Type: text/plain; charset="utf-8"
To: Robert Sander <r.sander@heinlein-support.de>, netfilter@vger.kernel.org, netdev@vger.kernel.org

Don't put a public address on a lo device use a dummy eth interface ins=
tead=E2=80=8E. Any IP address and it's subnet assigned to a lo device i=
s =C2=A0marked as a marcian address and the traffic is dropped if it tr=
ies to leave the lo device.

I know that there is som old documentation out there (for example quagg=
a's documentation) that says you can do it =E2=80=8Ebut it's been wrong=
 since the 2.4 version off the kernel.=C2=A0
Linux treats the lo device differently that what routers call a loopbac=
k device. The dummy driver is the linux equivalent of what routers call=
 a loopback device.
=C2=A0 Original Message =C2=A0
=46rom: Robert Sander
Sent: Friday, January 8, 2016 04:32
To: netfilter@vger.kernel.org; netdev@vger.kernel.org
Subject: Configure ICMP error source address

Hi,

It is possible to change the source address of ICMP error messages
generated by the kernel via
/proc/sys/net/ipv4/icmp_errors_use_inbound_ifaddr. This is currently th=
e
only way to influence the source address as ICMP errors do not travel
through the NAT table (for obvious reasons).

We have the situation that our routers use RFC1918 addresses on their
transfer networks (which should be quite common nowadays to save on
public IPv4 addresses). ICMP errors are generated with RFC1918 source
addresses and therefor never reach the original sender.

Every router has its public IP address bound to dev lo to be reachable
even if any one interface is down. Routing protocols assure that.

Is it a good idea to develop a kernel patch that makes it possible to
select the first IPv4 address on dev lo with scope global as the source
address for ICMP errors? Would that do any harm to the Internet at larg=
e?

Regards
--=20
Robert Sander
Heinlein Support GmbH
Schwedter Str. 8/9b, 10119 Berlin

http://www.heinlein-support.de

Tel: 030 / 405051-43
=46ax: 030 / 405051-19

Zwangsangaben lt. =C2=A735a GmbHG:
HRB 93818 B / Amtsgericht Berlin-Charlottenburg,
Gesch=C3=A4ftsf=C3=BChrer: Peer Heinlein -- Sitz: Berlin