1

I have a test setup with one host on a network (10.1.0.0/16) talking via TCP to another one on another network (10.2.0.0/16) and a gateway in the middle.

Sometimes, the TCP connection is lost and while scanning the trace (pcap), I looks like it's because of just one ICMP Host unreachable message sent by the gateway to 10.1.0.1 at some point. 10.1.0.1 then sends a TCP RST to 10.2.0.1.

In my opinion, the gateway (pfSense) is broken or not configured correctly but anyway, for testing purposes, I'd like to block this kind of ICMP on the host (10.1.0.1) before it has an influence on my TCP connection (or does it? I'm not even sure).

I've tried iptables:

iptables -I INPUT -i eth0 -p icmp --icmp-type host-unreachable -j DROP

but while it does a good job at preventing userpace applications like ping from receiving these ICMP messages, my TCP connection still comes to an end when the alleged "killer ICMP packet" is sent by the gateway.

Am I right about how it is processed? If yes, then what can I do to achieve my goal?

1 Answer 1

0

You have incorrectly assumed the ICMP message is the cause of your problem. Rather, the ICMP message is helping you diagnose the issue.

The RST is the actual root cause. You can provide more details about the TCP connection in question to get to the bottom of the issue.

3
  • According to tools.ietf.org/html/rfc1122#page-104 Destination Unreachable -- codes 2-4 These are hard error conditions, so TCP SHOULD abort the connection. TCP can be interrupted by such ICMP messages.
    – bbc
    Nov 8, 2013 at 20:40
  • It appears I'm wrong, the ICMP packet the gateway sends has code 1 which is considered as a soft error condition.
    – bbc
    Nov 8, 2013 at 20:58
  • You were definitely right about that. The gateway stopped forwarding the packets on another basis: poor routing caused packets to go through the gateway only in one direction. I suspect that its OS, pfSense, considers such TCP connections to be potentially broken but I can't confirm that at the moment.
    – bbc
    Jun 24, 2014 at 20:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .