Re: DNAT hiding routers behind it

[Simon Lodal <simonl@parknet.dk>]

No Linksys here, the firewall is a linux PC, the "router" is an Extreme 
Networks Summit 200 switch that acts like a router.

I do not think it matters. Point is that the router sends an icmp 
ttl-exceeded, which the firewall apparently considers part of the 
connection, and therefore does reverse DNAT on.

My problem is why it does that, and if it can be avoided.


Simon


Dick St.Peters skrev:
> Simon Lodal writes:
> 
>>I am traceroute'ing a DNAT'ed host. Surprisingly, all routers between 
>>the DNAT'ing firewall and the host appear as the IP address I am 
>>traceroute'ing. Is this intended? Can it be controlled in some way? (it 
>>is not necessarily bad)
>>
>>Example:
>>traceroute to 217.116.235.62 (217.116.235.62), 30 hops max, 38 byte packets
>>  1  192.168.0.2 (192.168.0.2)  4.152 ms  0.875 ms  0.865 ms
>>  2  217.116.235.62 (217.116.235.62)  1.928 ms  1.272 ms  1.430 ms
>>  3  217.116.235.62 (217.116.235.62)  2.013 ms  2.338 ms  2.330 ms
>>
>>Line 1: DNAT'ing firewall.
>>Line 2: A router.
>>Line 3: DNAT'ed host.
> 
> 
> Is the router a small Linksys router?  They do this without being
> behind a firewall or NAT box.
> 
> --
> Dick St.Peters, stpeters@NetHeaven.com