Messages in this thread | | | From | Nigel Metheringham <> | Subject | Re: IP Masq question in pre-2.0.31-1 | Date | Mon, 14 Jul 1997 11:20:36 +0100 |
| |
} Just out of curiosity, why is the code that prints things like: } } MASQ: forward ICMP: failed checksum from 208.136.4.175! } MASQ: forward ICMP: failed checksum from 151.200.189.101! } } outside the ifdef's for CONFIG_IP_MASQUERADE_ICMP. i.e. I don't have } CONFIG_IP_MASQUERADE_ICMP set in this kernel though I do have } CONFIG_IP_MASQUERADE, yet am seeing the above on a multi-ether linux } router. Is there a good reason not obvious to me, or is it an oversight?
Its not an oversight (honest!).
The code for handling ICMP actually breaks down into 2 different sections:-
1. Code handling ICMP packets which are associated with TCP/UDP connections [I use "connections" rather loosely here]. ie ICMP packets related to PATH MTU discovery etc. This basically means that ICMP packets that are for destination unreachable, ttl exceeded or source quench AND the embedded proto information is for an already masq-ed connection are handled.
2. Code handling all ICMP packets as ICMP...
The code to handle (1) existed before the real ICMP handling code was written - it came in a bit before 2.0.0. Without that code all sorts of things fall apart - especially if you try and do MTU discovery. [incidently if ICMP handling is disabled ping from inside the masq network doesn't work - as expectec - BUT Unix traceroute does work since it uses UDP probe packets and gets ICMPs back related to those packets. MS tracert doesn't work without full ICMP support since it uses ICMP probe packets].
Nigel.
-- [ Nigel.Metheringham@theplanet.net - Systems Software Engineer ] [ Tel : +44 113 251 6012 Fax : +44 113 224 0003 ] [ Friends don't let friends use sendmail! ]
| |