icmp redirect
I am developing an application that will eventually run on a PC with two ethernet cards; unfortunately the development PC that I use has only one ethernet card (eth0) and no available slots (except for one that I need for another purpose).
Doesn't matter, during the development I can have both applications use eth0 instead, if I can only stop the icmp redirect messages that the kernel sends back to the source, whenever it finds out that it is forwarding a packet via the same eth0 interface on which it came in.
Of course, I can choke the icmp redirect message using iptables, but is there a better (proper) way, to prevent the message from being generated?
Jan Humme.
Quoted 5 lines · Jan Humme
I am developing an application that will eventually run on a PC with two ethernet cards; unfortunately the development PC that I use has only one ethernet card (eth0) and no available slots (except for one that I need for another purpose).
Quoted 7 lines
Doesn't matter, during the development I can have both applications use eth0 instead, if I can only stop the icmp redirect messages that the kernel sends back to the source, whenever it finds out that it is forwarding a packet via the same eth0 interface on which it came in.
Of course, I can choke the icmp redirect message using iptables, but is there a better (proper) way, to prevent the message from being generated?
On the sending host:
# echo 0 > /proc/sys/net/ipv4/conf/*/send_redirects
On the receiving host:
# echo 0 > /proc/sys/net/ipv4/conf/*/accept_redirects
should do it.
Ramin
Quoted 2 lines
Jan Humme.
Quoted 14 lines · Ramin Alidousti
Quoted 5 lines · Jan Humme
I am developing an application that will eventually run on a PC with two ethernet cards; unfortunately the development PC that I use has only one ethernet card (eth0) and no available slots (except for one that I need for another purpose).
Quoted 7 lines
Doesn't matter, during the development I can have both applications use eth0 instead, if I can only stop the icmp redirect messages that the kernel sends back to the source, whenever it finds out that it is forwarding a packet via the same eth0 interface on which it came in.
Of course, I can choke the icmp redirect message using iptables, but is there a better (proper) way, to prevent the message from being generated?
Quoted 7 lines
On the sending host:
# echo 0 > /proc/sys/net/ipv4/conf/*/send_redirectsOn the receiving host:
# echo 0 > /proc/sys/net/ipv4/conf/*/accept_redirectsshould do it.
Thanks a lot; I knew there was an elegant way :-) !
Jan Humme.
Quoted 5 lines · Jan Humme
I am developing an application that will eventually run on a PC with two ethernet cards; unfortunately the development PC that I use has only one ethernet card (eth0) and no available slots (except for one that I need for another purpose).
Quoted 7 lines
Doesn't matter, during the development I can have both applications use eth0 instead, if I can only stop the icmp redirect messages that the kernel sends back to the source, whenever it finds out that it is forwarding a packet via the same eth0 interface on which it came in.
Of course, I can choke the icmp redirect message using iptables, but is there a better (proper) way, to prevent the message from being generated?
Does it help if you put two addresses onto eth0 from different subnets (eg 192.168.0.1 and 172.16.0.1) so that icmp redirect is no longer appropriate (because this is used only between machines on a single subnet) ?
Then your other machines which are talking to it can pretend that one address is eth0 and the other address is eth1.
Antony.
Quoted 11 lines · Antony Stone
Quoted 10 lines · Jan Humme
I am developing an application that will eventually run on a PC with two ethernet cards; unfortunately the development PC that I use has only one ethernet card (eth0) and no available slots (except for one that I need for another purpose).
Doesn't matter, during the development I can have both applications use eth0 instead, if I can only stop the icmp redirect messages that the kernel sends back to the source, whenever it finds out that it is forwarding a packet via the same eth0 interface on which it came in.
Quoted 6 lines
Quoted 2 lines
Of course, I can choke the icmp redirect message using iptables, but is there a better (proper) way, to prevent the message from being generated?
Does it help if you put two addresses onto eth0 from different subnets (eg 192.168.0.1 and 172.16.0.1) so that icmp redirect is no longer appropriate (because this is used only between machines on a single subnet) ?
That is exactly what I am doing, and lo-and-behold! tcpdump reveals an icmp-redirect message.
=> 192.168.255.254: my firewall/internet gateway
=> 192.168.0.1 (eth0) alias 1.2.3.254 (eth0:0) my development machine, using 192.168.255.254 as the gateway
=> 1.2.3.4 my Windoze test machine, using 1.2.3.254 as its gateway
So when the Windoze machine tries to ping, say 194.134.32.32, it forwards the packet to 1.2.3.254, who forwards it back onto the same eth0 towards 192.168.255.254.
Also, an icmp-redirect message is sent back to the Windoze-machine, telling it to forward those packets straight to 192.168.255.254 from now on.
Quoted 2 lines
Then your other machines which are talking to it can pretend that one address is eth0 and the other address is eth1.
I wouldn't know how to tell this to my test Windoze box.
Jan Humme.