netdev - Re: Configure ICMP error source address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 15 Feb 2016 10:13:15 +0100
From:	Robert Sander <r.sander@...nlein-support.de>
To:	netfilter@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: Configure ICMP error source address

On 08.01.2016 10:31, Robert Sander wrote:

> We have the situation that our routers use RFC1918 addresses on their
> transfer networks (which should be quite common nowadays to save on
> public IPv4 addresses). ICMP errors are generated with RFC1918 source
> addresses and therefor never reach the original sender.

A follow-up to this request:

It is much easier to accomplish when settings routes with a source
address that is a public IP like this:

ip route add default via 10.10.10.1 src 192.0.2.24

ICMP errors will then use 192.0.2.24 as the source address.

No need for a kernel patch. Thanks for all the input.

Regards
-- 
Robert Sander
Heinlein Support GmbH
Schwedter Str. 8/9b, 10119 Berlin

http://www.heinlein-support.de

Tel: 030 / 405051-43
Fax: 030 / 405051-19

Zwangsangaben lt. §35a GmbHG:
HRB 93818 B / Amtsgericht Berlin-Charlottenburg,
Geschäftsführer: Peer Heinlein -- Sitz: Berlin

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)