Re: Messages in log with SNAT target

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Anssi Hannula a écrit :
> 
> I've been using this kind of configuration on my Linux router for a few
> years:
> 
> eth0	80.223.77.223, public internet ip
> eth0:0	10.0.0.1, private network ip

You know that having both internet and a private LAN on the same 
interface is a *very* bad idea, don't you ? I suppose you have no other 
choice.

> IP forwarding enabled.
> 
> And a rule for iptables:
> -A POSTROUTING -s 10.0.0.0/255.255.255.0 -d ! 10.0.0.0/255.255.255.0 -j
> SNAT --to-source 80.223.77.223
> 
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
> 10.0.0.0        0.0.0.0         255.255.255.0   U     10     0        0 eth0
> 80.223.64.0     0.0.0.0         255.255.240.0   U     10     0        0 eth0
> 0.0.0.0         80.223.64.1     0.0.0.0         UG    10     0        0 eth0
> 
> However, I get lots of this kind of messages in the dmesg while routing:
> host 10.0.0.4/if2 ignores redirects for 70.35.xxx.xxx to 80.223.64.1.
[and so on]

Here's what happens. On your router box, all routes use the same 
interface eth0, so when it receives a packet for another destination 
than the box itself, it sends an "ICMP Redirect" message to the source 
IP address meaning "hey, there is a more direct route to destination 
70.35.x.x using gateway 80.223.64.1 instead of me. Please update your 
routing table".

Happily, the 1.0.0.4 host ignores the "ICMP Redirect" messages. One 
reason is I think that's a default behaviour of Windows NT. Another 
reason is that host has probably no direct route to the proposed gateway 
address. Anyway, if it didn't ignore the "ICMP Redirect", it would 
probably lose connectivity with internet hosts because of its private 
address.

Note : destination NAT (DNAT) on the same network blocks the sending of 
"ICMP Redirect" messages by the routing decision, because destination 
NAT takes place before the routing decision. But source NAT (SNAT, 
MASQUERADE) doesn't, because it takes place after the routing decision, 
so it's too late (see Netfilter diagram in 
http://www.netfilter.org/documentation/HOWTO//NAT-HOWTO.txt).

You can enable or disable the sending of "ICMP Redirect" messages with 
the kernel parameter send_redirect.

send_redirects - BOOLEAN
      Send redirects, if router.
      send_redirects for the interface will be enabled if at least one of
      conf/{all,interface}/send_redirects is set to TRUE,
      it will be disabled otherwise
      Default: TRUE

To disable sending "ICMP redirect" on eth0 :

echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects

or :

sysctl -w net/ipv4/conf/all/send_redirects=0
sysctl -w net/ipv4/conf/eth0/send_redirects=0