/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Sorry, not sure if this was answered earlier or not.
> When I'm trying to ping some host in the corporate net from
> some host on the
> LAN (which is not permitted to traverse the corporate
> firewall) immediately
> after it came up, the first packet passes the firewall but all the
> subsequent do not. I beleive that when Linux receives the
> first packet it
> forwards it properly but it also answers to the pinging host
> (perhaps with
> ICMP Redirect packet - I am not familar enough with IP
> protocol details)
> that there is the shorter route to the corpnet - directly
> through 10.8.6.1.
Actually I believe it's the router which will issue the icmp redirect
announcing the shorter route. [It is of the opinion that it handles routing
for your subnet.] You'd have to turn off it's sending of ICMP redirects.
It can be done but then you'd have to get corporate involved since they
control the router.
Or you have to turn off all of the machines ability to respond to ICMP
redirects.
The first way is the proper way of handling this situation provided you must
use the same subnet addresses. The second tends to break every time some
setup changes on the local machines.
An even better solution however would be to put the machines needed to be
masq'd (temporary measure until corporate makes the proper configuration) on
their own setup. Let corporate know what this address is used for so they
can issue the appropriate policies. Setup SAMBA and run the masq'd machines
in their own workgroup (network neighborhood should still work though you
have to drill down one more level). Then when corporate makes the proper
setup you should only have to change the ip address and the workgroup name
on the masq'd machine.
Lourdes
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
