On Fri, Apr 11, 2003 at 08:58:00PM +0200, Jozsef Kadlecsik <kadlec@xxxxxxxxxxxxxxxxx> wrote: > > No, the problem is that when the firewall machine REJECTs any packets in a > > FORWARD chain (ie, anything I am blocking that is destined to the network > > behind it), the source IP of the ICMP UNREACH (or evn the RST packets) is > > that of the *outside* interface - the unroutable address. It seems the > > POSTROUTING is not performed on the ICMPs that are created by the actual > > host. > > If this is a problem of the forwarded packets, then it has nothing to do > with the connections initiated from/targeted to the firewall itself. What? Of course it does! I have a rule like: iptables -A Firewall -p tcp --dport 1434 -j REJECT where 'Firewall' is iptables -A FORWARD -i eth1 -j Firewall The above rule will generate an ICMPUNREACH if it tries to forward a packet coming in eth1 that is destined for port 1434 to anything behind the firewall machine. This UNREACH is generated with a source IP of my firewalls *outside* interface, which is the unrouteable address (and is filtered by my ISP). I need this ICMP to be generated with a source IP of my *inside* interface, instead. > But if the packets created by the REJECT target contain the address of the > firewall, then the packet they are rejecting was targeted to the firewall. No, see above. > Show me the tcpdump of both the packets rejected and the reject packets > generated. 12:05:31.037765 66.220.X.Y.38487 > 67.122.A.B.ms-sql-m: S 2857026105:2857026105(0) win 5840 <mss 1460,sackOK,timestamp 406253139 0,nop,wscale 0> (DF) [tos 0x10] 12:05:31.037805 10.0.0.1 > 66.220.X.Y: icmp: 67.122.196.121 tcp port ms-sql-m unreachable [tos 0xd0] Notice how the source address on the ICMP unreach is the unroutable IP. I need it to be an address on the 67.122.n.n address block (my inside interface). Refer to my original email w/ diagram again, if you need to :) -Taner
