Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On my firewall/router Linux box I quite often see ICMP host/port unreachable errors like:

    Jan 10 10:11:56 localhost kernel: [80413.542607] firewall-invl: IN=wan OUT=
    MAC=c8:60:00:e1:0f:7c:00:01:5c:22:e0:c1:08:00 SRC=95.37.140.148 DST=my-public-ip 
    LEN=162 TOS=0x00 PREC=0x20 TTL=51 ID=2053 PROTO=ICMP TYPE=3 CODE=1
    [SRC=my-public-ip DST=10.10.10.103 LEN=134 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF 
     PROTO=UDP SPT=4608 8 DPT=13298 LEN=114 ]

Here, "my-public-ip" is the external dynamic IP assigned to iface "wan" by the ISP. Another iface, "br0", is connected to my 10.0.0.0/24 LAN.

If I am reading this correctly, then a host at 95.37.140.148 (Russia, mts-nn.ru) sends me an ICMP host-unreachable message in reply to one of LAN machine's request for a 10.10.10.103.

However this is very confusing for me, as in the FORWARD chain there is a rule which specifically blocks such requests (along with 192.168.0.0/16 and 172.16.0.0/12) from inside the LAN

    -A FORWARD -d 10.0.0.0/8 -i br0 -j REJECT --reject-with icmp-host-unreachable

For example, traceroute returns the correct "!H"

    $ traceroute 10.10.10.103
    traceroute to 10.10.10.103 (10.10.10.103), 30 hops max, 60 byte packets
    1  10.0.0.1 (10.0.0.1)  2.534 ms  2.496 ms  2.499 ms
    2  10.0.0.1 (10.0.0.1)  2.535 ms !H  2.617 ms !H  2.637 ms !H

So, how do I make sense of the above log entry?

share|improve this question

1 Answer 1

-A FORWARD -d 10.0.0.0/8 -i br0 -j REJECT --reject-with icmp-host-unreachable doesn't block host unreachable requests, it generates them in response to certain conditions.

Cheers,

Rob

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.