Hi I seem to be having problems with icmp redirects My network setup, I have sydrt01 eth0 192.168.11.1/24 eth1 192.168.10.1/24 ppp0 attached to eth2 internet max eth0 192.168.11.10/24 DGW 192.168.11.1 because sydrt01 only have 10/100 ports I moved 192.168.10.1/24 (my wireless to max), which had a spare 1g port. so I ended up with sydrt01 eth0 192.168.11.1/24 ppp0 attached to eth2 internet max eth0 192.168.11.10/24 eth1 192.168.10.1/24 I add a ip r r 192.168.10.0/24 via 192.168.11.10 to sydrt01 and I see that sydrt01 sends out the icmp redirects. But in this situation when I have laptop connected to 192.168.11.0/24 (192.168.11.200) and I have alex-mini connected to 192.168.10.0/24 (192.168.10.201), I can ssh from alex-mini to laptop, pings seem to work but ssh has a problem. When I investigated this, tcpdump -pni eth0 hostname alex-mini or icmp on laptop, I can see that the return packets (syn-ack) goes to sydrt01 (DGW) and a icmp comes back to redirect - which laptop fails to act upon. I tried ping -c 6 alex-mini from laptop and after each icmp ping advised that there was a icmp redirect, but again the kernel did not take the information in. I have net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.secure_redirects = 1 (presume all the interface ones are 1) as my default, the documentation seems to suggest that I don't need the former for the later to work ie I can have either one. But for me to get this to work I had to set net.ipv4.conf.all.accept_redirects = 1 net.ipv4.conf.all.secure_redirects = 1 to get it to work properly. My understanding is secure_redirects means that the kernel should listen to icmp redirect if the redirect comes from the default gateway as per the route table. laptop gets its ip from dchp server that make 192.168.11.1 the default gateway and its 192.168.11.1 that sends out the icmp redirect. I had a quick look at the kernel tree for 2.6.31 (which is what I am using). I am no expert of the kernel source. but from what I found http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.31.y.git;a=blob;f=net/ipv4/icmp.c;h=97c410e8438895664a9abdbbf5670b26af01dffa;hb=HEAD line 774 which handles the icmp redirects uses ip_rt_redirect http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.31.y.git;a=blob;f=net/ipv4/route.c;h=278f46f5011beb2ab85747543f84dfd3ce7c6d1c;hb=HEAD line 1334 has ip_rt_redirect This is where I loose it a bit my guess is line 1349 which seems to check to see if redirects are allow does a IN_DEV_RX_REDIRECTS and this macro (http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.31.y.git;a=blob;f=include/linux/inetdevice.h;h=ad27c7da87986da346da3d62f29e88bec957280a;hb=HEAD) and I think it fails the test here and thus get bounced out. Which sort of corrosponds to what i have seen - but doesn't match up with the documentation http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.31.y.git;a=blob;f=Documentation/networking/ip-sysctl.txt;h=8be76235fe6724c43e0c2b39778f3f741e53b619;hb=HEAD Line 680 secure_redirects - BOOLEAN 681 Accept ICMP redirect messages only for gateways, 682 listed in default gateway list. 683 secure_redirects for the interface will be enabled if at least one of 684 conf/{all,interface}/secure_redirects is set to TRUE, 685 it will be disabled otherwise 686 default TRUE I had conf/interface/secure_redirect = 1 and conf/all/secure_redirect=1 Thanks Alex PS I am not subscribed please cc me on replies thanks
Attachment:
signature.asc
Description: Digital signature
