/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Lourdes Jones <[EMAIL PROTECTED]> wrote:
>
> I had understood that the client machines were already set at 576.
Well, if that's the case, then it can't be a client configuration
problem. Of course, the client will not send any packets that need
fragmentation going out, but the server has its own MTU, and will need
to discover the MTU coming back. Configuring the client to a smaller
MTU won't make any difference in that case, now that I think on it.
> That presumes that the linux box is properly handling fragmented
> packets. My concern was that the Masq box was not handling fragmented
> packets properly. [I seem to remember fragmented packet handling for
> masqued packets was broken on some of the ports for a bit.]
I think that fragmentation will *always* lead to broken behavior on a
masq box, if the box is not configured with the CONFIG_IP_ALWAYS_DEFRAG
option. However, I am led to believe that later (2.2) kernels no longer
make this an option, and they will always defragment packets before
forwarding them, when masq is enabled. I would be interested to learn
otherwise, though!
> I've run into boxes where someone set DF on, MTU 1500 and then blocked
> all inbound ICMP traffic. My bank was that way for a while when they
> first set up their secured server. :(
Yes, it's broken configurations like this (more common than one might
think) that cause these types of problems. Many posters on the ipchains
list have asked, "How can I disable ALL incoming ICMP?" and it can be
difficult to explain why that is not a very good idea.
Still, a configuration like this is clearly broken, and can't be fixed
on the Linux box side. While there are still people who believe that
there is a bug in the handling of DF packets and ICMP replies in the
masq code, the masq developers have yet to be convinced of it.
--
[EMAIL PROTECTED] (Fuzzy Fox) || "Good judgment comes from experience.
sometimes known as David DeSimone || Experience comes from bad judgment."
http://www.dallas.net/~fox/ || -- Life Lessons
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
