/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Fuzzy Fox wrote:
>
> I think that fragmentation will *always* lead to broken behavior on a
> masq box, if the box is not configured with the CONFIG_IP_ALWAYS_DEFRAG
> option.
Usually not always :) But that might also depend on the kernel version.
It's been a long time since I even tried running without defrag being set.
> However, I am led to believe that later (2.2) kernels no longer
> make this an option, and they will always defragment packets before
> forwarding them, when masq is enabled. I would be interested to learn
> otherwise, though!
I believe early 2.2 kernels let you select masq without defragmenting. Soon
there after you had to select always defragment before the masq option was
even visible. The latest releases do not display the defragment option any
longer and set it automatically for you when you select masq. I know it's
true with 2.2.15pre3, I just double-checked with 'make menuconfig'. I
usually build with 'make oldconfig' so I can't tell you exactly when the
changes happened.
> Still, a configuration like this is clearly broken, and can't be fixed
> on the Linux box side. While there are still people who believe that
> there is a bug in the handling of DF packets and ICMP replies in the
> masq code, the masq developers have yet to be convinced of it.
There appeared to be a bug where if the client machine had a smaller MTU
than the masq machine, the client machine would send the path discovery
packet to the originating server but the masq machine failed to masq that
packet so it went out with the internal (not routable) address so the whole
process fell on it's face.
Placing a logging command in the firewalling code similar to 'ipchains -A
output -i ppp0 -s $internal-address-range -l' (then visiting the offending
sites) could be a means of seeing if this might apply. If my mind is not
too fogged, the packets have already been masqueraded before hitting the
output chain so any internal address packets passing through the interface
are a sign of trouble.
Sorry I'm so slow today, I've got a nasty case of sinusitis and have been
running a fever for a few days now. Thank you very much for pointing out
when I've been unclear or misleading.
Lourdes
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
