On Wednesday 19 May 2004 10:11 pm, Bart Matthaei wrote:
> Hi All,
>
> I have the following problem:
>
> I have a tunnel between my home router and my colocated machine.
> I use source routing (iproute) to route all traffic coming from my home
> network (public ipspace) over the tunnel.
>
> Everything works fine. But when a user traceroutes a host in my home
> network, or sends traffic to an unreachable host, all ICMP replies are
> coming from the ip address of my cable connection (eth0), which is still
> the default route on the home router itself.
I don't see that the result could be any different, since the source of the
packets going back to the external address really is your cable connection on
eth0 - not an internal address which can be used to match any source-routing
rule.
If someone pings (or telnets, or whatever) an unreachable host on your network
(or should that be an unreachable host not on your network...?), then the
host itself obviously cannot send back a response - it is the upstream router
which does this, and the source address of the response it sends is that of
its own external interface.
Maybe you should block incoming traceroutes (ie don't send back TTL exceeded
ICMP responses), and be selective about what other ICMP responses you allow
back (such as host / port / network unreachable)?
Regards,
Antony.
--
Bill Gates has personally assured the Spanish Academy that he will never allow
the upside-down question mark to disappear from Microsoft word-processing
programs, which must be reassuring for millions of Spanish-speaking people,
though just a piddling afterthought as far as he's concerned.
- Lynne Truss, "Eats, Shoots and Leaves"
Please reply to the list;
please don't CC me.
