Re: icmp forward

[Mart Frauenlob <mart.frauenlob@chello.at>]

Hinko Kocevar wrote:
> Pascal Hambourg wrote:
>   
>> Hello,
>>
>> Hinko Kocevar a écrit :
>>     
>>> Christoph Paasch wrote:
>>>       
>>>> On Fri January 30 2009, Hinko Kocevar wrote:
>>>>         
>>>>> Is it possible to 'port forward' ICMP requests?
>>>>>           
>>>> You can match the protocol on ICMP packets with -p icmp and let the
>>>> port-
>>>> specific stuff out of it, as ICMP doesn't uses portnumbers. But the
>>>> problem will be, that your external machine won't be reachable for
>>>> icmp packets. (as every icmp packets will get forwarded) It may be
>>>> ennoying if MTU or ping packets doesn't reach anymore your machine.
>>>> That depends on the usage of your gateway.
>>>>         
>>> Yes, that is what I was afraid of. I think that gateway should still
>>> remain
>>> available for ICMP echo-reply from external network.
>>>       
>> You must not be afraid of redirecting incoming ICMP replies or error
>> messages originally destined to the gateway to the mobile device. These
>> messages have the state ESTABLISHED or RELATED, while NAT rules see only
>> packets creating a new "connection", which have the state NEW. Even
>> though, you could have your DNAT rule match only the echo-request type
>> with the --icmp-type option. However, if you redirect ICMP echo request
>> to the device, indeed you cannot ping the gateway any more on the same
>> external address. You need a separate address.
>>     
>
> Not quite sure what it is all about, but is it doing something like:
> # ifconfig eth0:1 172.31.64.121 netmask 255.255.254.0 up
>
> And later..
> # iptables -A FORWARD -p icmp --icmp-type echo-request -j ACCEPT
> # iptables -t nat -A PREROUTING -i eth0 -p icmp -j DNAT --to-destination 10.1.1.2
>
>   
try:

iptables -t nat -A PREROUTING -i eth0 -d 172.31.64.121 -p icmp -j DNAT --to-destination 10.1.1.2


> This is not what I expected - shouldn't the request destined for eth0:1 be
> answered by the gateway device?
>