lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:	Sat, 14 May 2016 02:13:41 +0200
From:	Marcin Szewczyk <>
Subject: No "unreachable" response for an outgoing TCP connection when using


I hope this is the right group even though it concerns mainly
development but I have not found a better one.

I would like to route locally-generated traffic:
- to a TCP port "A" of host "H" via the interface "A",
- to a TCP port "B" of host "H" via the interface "B".

Interface "B" is sometimes unavailable. Then I would like the kernel to
notify the user with "Network is unreachable" error if one tries to
connect to the TCP port "B".

I have tried the following settings (when the interface "B" is down):

# iptables -t mangle -nvL OUTPUT
Chain OUTPUT (policy ACCEPT 2 packets, 120 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    2   120 MARK       all  --  *      *            host-H-ip         MARK set 0x64
(for simplicity the rule does not include ports yet)

# ip rule
0:      from all lookup local 
32765:  from all fwmark 0x64 lookup 200 
32766:  from all lookup main 
32767:  from all lookup default

# ip route show table 200
prohibit default

There are no surprises when the interface "B" is available and the 200
table contains a regular routing rule.

But when the interface "B" is not available I get satisfactory results
only for ICMP and UDP:

$ ping host-H-ip
PING host-H-ip (host-H-ip) 56(84) bytes of data.
ping: sendmsg: Network is unreachable

$ nc -nuv host-H-ip 5000
(UNKNOWN) [host-H-ip] 5000 (?) open
too many output retries : Network is unreachable

For TCP it just hangs:
$ nc -nv host-H-ip 5000

I have found some threads that seem to be connected with the topic:

Unfortunately, I still do not understand why I do not get "Network is
unreachable" for TCP as well. Could anybody explain it to me?

Best regards,

Marcin Szewczyk

Powered by blists - more mailing lists