Hello,
Hinko Kocevar a écrit :
Christoph Paasch wrote:
On Fri January 30 2009, Hinko Kocevar wrote:
Is it possible to 'port forward' ICMP requests?
You can match the protocol on ICMP packets with -p icmp and let the port-
specific stuff out of it, as ICMP doesn't uses portnumbers. But the problem will
be, that your external machine won't be reachable for icmp packets. (as every
icmp packets will get forwarded) It may be ennoying if MTU or ping packets
doesn't reach anymore your machine. That depends on the usage of your gateway.
Yes, that is what I was afraid of. I think that gateway should still remain
available for ICMP echo-reply from external network.
You must not be afraid of redirecting incoming ICMP replies or error
messages originally destined to the gateway to the mobile device. These
messages have the state ESTABLISHED or RELATED, while NAT rules see only
packets creating a new "connection", which have the state NEW. Even
though, you could have your DNAT rule match only the echo-request type
with the --icmp-type option. However, if you redirect ICMP echo request
to the device, indeed you cannot ping the gateway any more on the same
external address. You need a separate address.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
