Modify

Opened 9 years ago

Closed 9 years ago

#4397 closed defect (wontfix)

router sends invalid "redirect host" (icmp) message

Reported by: allgemein@… Owned by: developers
Priority: low Milestone:
Component: kernel Version:
Keywords: icmp redirect host invalid Cc:

Description

My router has two different networks (A and B) configured on one network interface. Traffic for specific destination hosts originating from network A is supposed to be routed through a gateway in network B.
In general this setup works as expected.

But even though the networks A and B have different address ranges, the wrt occassionally sends icmp type 5 code 1 ("redirect host") messages to hosts in network A. This violates the definition of this ICMP message.
See the rfc (http://tools.ietf.org/html/rfc792) and a short abstract (http://www.networksorcery.com/enp/protocol/icmp/msg5.htm) for details.

These ICMP messages cripple the connections from hosts in network A to network B significantly. I "fixed" this by adding the following iptables rule:

iptables -I OUTPUT -d 192.168.0.0/16 -p icmp --icmp-type host-redirect -j DROP

This blocks any outgoing icmp "redirect host" messages from the wrt. I did not experience any further problems since then.

My current setup is:

  • Linksys WRT54G
  • Kamikaze 7.09
  • Linux 2.6.22

the two networks on the lan bridge interface:

root@OpenWrt:~# ifconfig br-lan; ifconfig br-lan:0
br-lan    Link encap:Ethernet  HWaddr 00:0F:66:5B:61:5C  
          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1722434 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2197793 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:647949119 (617.9 MiB)  TX bytes:1999827114 (1.8 GiB)

br-lan:0  Link encap:Ethernet  HWaddr 00:0F:66:5B:61:5C  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

The routing:

root@OpenWrt:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
213.xxx.xxx.xxx 0.0.0.0         255.255.255.255 UH    0      0        0 ppp0
92.xxx.xxx.xxx  192.168.1.31    255.255.255.248 UG    0      0        0 br-lan
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br-lan
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 br-lan
0.0.0.0         213.xxx.xxx.xxx 0.0.0.0         UG    0      0        0 ppp0

Do you have any ideas, how I could debug this behaviour?

Attachments (0)

Change History (1)

comment:1 Changed 9 years ago by nico

  • Resolution set to wontfix
  • Status changed from new to closed

Your network setup is wrong, the router send icmp redirects to hosts on network A when they're accessing the gateway on network B because they're physically on the same network and there's no need to route packets to the router for that.

Anyway, there's no need to add an iptables rule to disable icmp redirects. Just add the following line to /etc/sysctl.conf

net.ipv4.conf.all.send_redirects = 0

Add Comment

Modify Ticket

Action
as closed .
The resolution will be deleted. Next status will be 'reopened'.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.