On Wed, May 19, 2004 at 10:33:27PM +0100, Antony Stone wrote:
> On Wednesday 19 May 2004 10:11 pm, Bart Matthaei wrote:
>
> > Hi All,
> >
> > I have the following problem:
> >
> > I have a tunnel between my home router and my colocated machine.
> > I use source routing (iproute) to route all traffic coming from my home
> > network (public ipspace) over the tunnel.
> >
> > Everything works fine. But when a user traceroutes a host in my home
> > network, or sends traffic to an unreachable host, all ICMP replies are
> > coming from the ip address of my cable connection (eth0), which is still
> > the default route on the home router itself.
>
> I don't see that the result could be any different, since the source of the
> packets going back to the external address really is your cable connection on
> eth0 - not an internal address which can be used to match any source-routing
> rule.
>
> If someone pings (or telnets, or whatever) an unreachable host on your network
> (or should that be an unreachable host not on your network...?), then the
> host itself obviously cannot send back a response - it is the upstream router
> which does this, and the source address of the response it sends is that of
> its own external interface.
>
> Maybe you should block incoming traceroutes (ie don't send back TTL exceeded
> ICMP responses), and be selective about what other ICMP responses you allow
> back (such as host / port / network unreachable)?
Ok. So it isn't possible to isolate certain icmp packets (which I already
did with the MARK trick) and send them with an alternative source address?
Cheers,
Bart
--
Bart Matthaei bart@xxxxxxxxxxxx
Sometimes a cigar is just a cigar.
-- Sigmund Freud
