R. DuFresne wrote: > On Mon, 10 Apr 2006, Nathaniel Hall wrote: > >> I have been trying to figure out how to change the source IP address of an >> ICMP packet that originates from the firewall. Here is my application. >> >> Instead of dropping a packet I reject it with ICMP host unreachable messages. >> I would like to make it appear that the firewall isn't there, so I would like to >> change the source IP address to be that of our upstream router. How would >> I go about doing this? > > by blocking the ICMP's at that upstream router. That doesn't achieve what I want. If a TCP connection is rejected at the firewall, then blocking ICMP at the upstream router will block the host-unreachable from going out, not make it seem as if the router is the source. -- Nathaniel Hall, GSEC GCFW GCIA
