Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a test setup with one host on a network (10.1.0.0/16) talking via TCP to another one on another network (10.2.0.0/16) and a gateway in the middle.

Sometimes, the TCP connection is lost and while scanning the trace (pcap), I looks like it's because of just one ICMP Host unreachable message sent by the gateway to 10.1.0.1 at some point. 10.1.0.1 then sends a TCP RST to 10.2.0.1.

In my opinion, the gateway (pfSense) is broken or not configured correctly but anyway, for testing purposes, I'd like to block this kind of ICMP on the host (10.1.0.1) before it has an influence on my TCP connection (or does it? I'm not even sure).

I've tried iptables:

iptables -I INPUT -i eth0 -p icmp --icmp-type host-unreachable -j DROP

but while it does a good job at preventing userpace applications like ping from receiving these ICMP messages, my TCP connection still comes to an end when the alleged "killer ICMP packet" is sent by the gateway.

Am I right about how it is processed? If yes, then what can I do to achieve my goal?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

You have incorrectly assumed the ICMP message is the cause of your problem. Rather, the ICMP message is helping you diagnose the issue.

The RST is the actual root cause. You can provide more details about the TCP connection in question to get to the bottom of the issue.

share|improve this answer
    
According to tools.ietf.org/html/rfc1122#page-104 Destination Unreachable -- codes 2-4 These are hard error conditions, so TCP SHOULD abort the connection. TCP can be interrupted by such ICMP messages. –  bbc Nov 8 '13 at 20:40
    
It appears I'm wrong, the ICMP packet the gateway sends has code 1 which is considered as a soft error condition. –  bbc Nov 8 '13 at 20:58
    
You were definitely right about that. The gateway stopped forwarding the packets on another basis: poor routing caused packets to go through the gateway only in one direction. I suspect that its OS, pfSense, considers such TCP connections to be potentially broken but I can't confirm that at the moment. –  bbc Jun 24 at 20:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.