On 07/15/08 15:25, Andrea Bencini wrote:
I have a local network (10.100.0.0/24) and my default gateway is a
firewall (fw;eth0=10.100.0.1) with linux OS and netfilter.
In the same network I have an other gateway (linux OS and netfilter) to
connect a local subnetwork (10.6.70.0/24). Gateway eth0 is 10.100.0.241
and gateway eth1 is 10.6.70.241.
In the local network (10.100.0.0/24) I have windows client (XP prof) and
default gateway of these is 10.100.0.1.
I want implement "icmp redirect" in the firewall (default gateway); What
do I have to add or to change in my firewall?
Are you sure that it is not happening already? There are some /proc
entries controlling how Linux behaves regarding ICMP redirects (should
it listen to and / or send them) that you can change. I think they both
are enabled by default, though your distro may throb them.
/proc/sys/net/ipv4/icmp_ratemask
/proc/sys/net/ipv4/icmp_ratelimit
/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
/proc/sys/net/ipv4/icmp_echo_ignore_all
I think you will be most interested in the last two. Check kernel
documentation (<kernel source>/Documentation/networking/ip-sysctl.txt)
for more information.
Grant. . . .
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
