On 02/06/2006 03:47 PM, John A. Sullivan III wrote: > Are the ICMP Destination Unreachable-Fragmentation Needed and DF Set > (type 3, code 4) packets sent in response to a TCP packet doing PMTU > discovery considered RELATED or does one need to allow NEW connections > for such packets? The man page says that ICMP errors are RELATED, but I seem to recall them showing up as ESTABLISHED instead. In any case, fragmentation needed errors are treated the same as other ICMP errors, and so an accept ESTABLISHED/RELATED rule is enough. > By the way, is there a way to specify code number in the --icmp-type > match? I think one can do -p 1 --icmp-type fragmentation-needed but I > usually use the numbers to avoid lookups, e.g., -p 1 --icmp-type 8. > Thanks - John The man page doesn't mention this, but if you run iptables -p icmp -h then it says you can use type/code, eg -p 1 --icmp-type 3/4
