Re: weird message in logs

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Is it a problem that it is dropping these ?  I tried option a .. it did not
seem to change anything.

|192.168.202.73| ---> |eth0 on internal firewall 192.168.200.1| ---> |eth0:1
on internal firewal 10.90.0.1| ----> |eth1 on other firewall
10.90.0.2| ----> | eth0 on other firewall 192.168.90.1| --- >
|192.168.90.10|

Basically, I was sshing to eth1 on the other firewall form 192.168.202.73
... I assume the redirect comes from the reply ?  technically, eth1 is on
the same physical network as 192.168.200.0/21 ... so is that why it is doing
the redirect ?  Is not logging these messages solving the problem ?  Or is
there a prolem at all ?  Thank you very much for your reply.

Peter

----- Original Message ----- 
From: "Jason Opperisano" <opie@xxxxxxxxxxx>
To: "netfilter" <netfilter@xxxxxxxxxxxxxxxxxxx>
Sent: Tuesday, October 19, 2004 3:44 PM
Subject: Re: weird message in logs


On Tue, Oct 19, 2004 at 01:52:28PM -0300, Peter Marshall wrote:
> Below is a message I get in my messages file.  Basically, there is a
company
> going to lease space from us.  I know it would have been easier to just
> stick another card in my firewall and give them a subnet, however, that is
> not possible for our setup (long story).  Anyway, I bult another firewall
> for them.  This firewall sits within our internal network (physically) and
> has 2 network cards.  The firewalls internal network card is for their
> netowrk; 192.168.90.0/24,  The external card has a network of its own
> 10.90.0.2.  My internal firewall has a sub interface eth0:1 with the
number
> 10.90.0.1  (eth0 is 192.168.200.1 and is the gateway to my companys
internal
> network).
>
> What I am doing at the moment is ssh'ing to the newly created firewall
> called rubidium on port 15422.  I get the following in my messages file.
> Does anyone know how to correct this problem.  It does not prevent me from
> sshing, however, I would prefer to not have errors in my log files.
>
> Oct 19 14:46:05 rubidium kernel: REJECT: INPUT IN=eth1 OUT=
> MAC=00:50:04:9b:7a:ee:00:50:04:68:df:06:08:00 SRC=10.90.0.1 DST=10.90.0.2
> LEN=484 TOS=0x10 PREC=0xC0 TTL=64 ID=58050 PROTO=ICMP TYPE=5 CODE=1
> GATEWAY=192.168.202.73 [SRC=10.90.0.2 DST=192.168.202.73 LEN=456 TOS=0x10
> PREC=0x00 TTL=64 ID=7787 DF PROTO=TCP SPT=15422 DPT=2510 WINDOW=8576
> RES=0x00 ACK PSH URGP=0 ]

machine 10.90.0.1 is sending an ICMP Redirect message to 10.90.0.2 saying
that the next hop for 192.168.202.73 is 192.168.202.73...

if you don't want to see these logs:

(a) disable the sending of ICMP Redirects on 10.90.0.1:
      sysctl -w net.ipv4.conf.eth0.send_redirects=0
(b) drop, but don't log "-p icmp --icmp-type 5/1" on 10.90.0.2
(c) accept, and don't log "-p icmp --icmp-type 5/1" on 10.90.0.2

if it were me--i'd opt for "a"

-j

-- 
Jason Opperisano <opie@xxxxxxxxxxx>



[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux