Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a test setup with one host on a network ( talking via TCP to another one on another network ( and a gateway in the middle.

Sometimes, the TCP connection is lost and while scanning the trace (pcap), I looks like it's because of just one ICMP Host unreachable message sent by the gateway to at some point. then sends a TCP RST to

In my opinion, the gateway (pfSense) is broken or not configured correctly but anyway, for testing purposes, I'd like to block this kind of ICMP on the host ( before it has an influence on my TCP connection (or does it? I'm not even sure).

I've tried iptables:

iptables -I INPUT -i eth0 -p icmp --icmp-type host-unreachable -j DROP

but while it does a good job at preventing userpace applications like ping from receiving these ICMP messages, my TCP connection still comes to an end when the alleged "killer ICMP packet" is sent by the gateway.

Am I right about how it is processed? If yes, then what can I do to achieve my goal?

share|improve this question
up vote 0 down vote accepted

You have incorrectly assumed the ICMP message is the cause of your problem. Rather, the ICMP message is helping you diagnose the issue.

The RST is the actual root cause. You can provide more details about the TCP connection in question to get to the bottom of the issue.

share|improve this answer
According to Destination Unreachable -- codes 2-4 These are hard error conditions, so TCP SHOULD abort the connection. TCP can be interrupted by such ICMP messages. – bbc Nov 8 '13 at 20:40
It appears I'm wrong, the ICMP packet the gateway sends has code 1 which is considered as a soft error condition. – bbc Nov 8 '13 at 20:58
You were definitely right about that. The gateway stopped forwarding the packets on another basis: poor routing caused packets to go through the gateway only in one direction. I suspect that its OS, pfSense, considers such TCP connections to be potentially broken but I can't confirm that at the moment. – bbc Jun 24 '14 at 20:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.