I have a Linux home router with eth0 ( and bridge br0 for LAN clients ( Bridge br0 contains eth1 (wired) and eth2 (wireless).

The router routes all LAN traffic via eth0 ( to an ADSL router ( via SNAT and from there to the Internet. (At the moment I wonder if I can do this without SNAT but that's not the issue for now.)

I would like to know how the LAN clients can get icmp messages for unreachable hosts. If a LAN client pings an unused IP in its own subnet (eg, I see destination host unreachable messages. How can I get those messages for other unreachable addresses that are not within the subnet of the LAN client? Should I add all of the unroutable, unknown nets as iptables rules or perhaps add them with iproute2 as unreachable addresses, on the linux router?

For example, is an address I don't use. If I do a traceroute from a lan client to, I see those packets travel as such:

# traceroute
traceroute to (, 30 hops max, 52 byte packets
 1  linuxrouter (  0.247 ms  0.143 ms  0.126 ms
 2  adslrouter (  0.526 ms  0.526 ms  0.322 ms
 3  isp.hop1 (194.109.w.x)  33.250 ms  33.376 ms  33.337 ms
 4  isp.hop2 (194.109.y.z)  61.811 ms !N  32.700 ms !N  32.639 ms !N

(I don't know why the very first hop of my isp forwards these)

Instead of this, I'd rather have the linux router reject any rfc1918 address. What are the best practices?

1 Answer 1


ICMP Unreachable packets are a special breed; they'll only be thrown back at your systems when a router cannot route for that destination, if the router's behaving correctly; you'll also need to make sure they aren't getting discarded by an overzealous firewall.

In the case of, the ISP is probably not filtering the RFC 1918 ranges out until hop 3 - but if the discard is due to an ACL filter, it'll just throw the packets away without sending an Unreachable response.

To get your linux router to drop the packets and throw unreachables, add a reject route:

route add -net netmask reject

You'll want to make this persistent - where you need to do this depends on your router's flavor of linux.

  • Yes, I expected this. Thanks a lot for your answer.
    – drumfire
    Sep 5, 2011 at 16:53
  • The reject target will by default send a port-unreachable, for the described use case it may be advisable to use reject --reject-with icmp-net-prohibited or icmp-net-unreachable?
    – jjmontes
    Oct 24, 2014 at 17:31
  • 1
    @jjmontes He's using traditional routing in the answer, so it will only ever issue ICMP. The targets you are referring to work a layer up and they are administered with iptables.
    – Zdenek
    Jan 24 at 15:38
  • @Zdenek true, my suggestion was for 'netfilter (iptables)' rules indeed, and the syntax above is for the usual 'iproute2' package. Thanks for the clarification.
    – jjmontes
    Jan 24 at 16:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .