PMTU-D and conntrack
Are the ICMP Destination Unreachable-Fragmentation Needed and DF Set (type 3, code 4) packets sent in response to a TCP packet doing PMTU discovery considered RELATED or does one need to allow NEW connections for such packets?
By the way, is there a way to specify code number in the --icmp-type match? I think one can do -p 1 --icmp-type fragmentation-needed but I usually use the numbers to avoid lookups, e.g., -p 1 --icmp-type 8. Thanks - John
Signature · 8 lines
John A. Sullivan III Open Source Development Corporation +1 207-985-7880 [email protected] If you would like to participate in the development of an open source enterprise class network security management system, please visit http://iscs.sourceforge.net
Quoted 4 lines · John A. Sullivan III
Are the ICMP Destination Unreachable-Fragmentation Needed and DF Set (type 3, code 4) packets sent in response to a TCP packet doing PMTU discovery considered RELATED or does one need to allow NEW connections for such packets?
The man page says that ICMP errors are RELATED, but I seem to recall them showing up as ESTABLISHED instead. In any case, fragmentation needed errors are treated the same as other ICMP errors, and so an accept ESTABLISHED/RELATED rule is enough.
Quoted 4 lines
By the way, is there a way to specify code number in the --icmp-type match? I think one can do -p 1 --icmp-type fragmentation-needed but I usually use the numbers to avoid lookups, e.g., -p 1 --icmp-type 8. Thanks - John
The man page doesn't mention this, but if you run iptables -p icmp -h then it says you can use type/code, eg -p 1 --icmp-type 3/4