On my firewall/router Linux box I quite often see ICMP host/port unreachable errors like:

    Jan 10 10:11:56 localhost kernel: [80413.542607] firewall-invl: IN=wan OUT=
    MAC=c8:60:00:e1:0f:7c:00:01:5c:22:e0:c1:08:00 SRC= DST=my-public-ip 
    LEN=162 TOS=0x00 PREC=0x20 TTL=51 ID=2053 PROTO=ICMP TYPE=3 CODE=1
    [SRC=my-public-ip DST= LEN=134 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF 
     PROTO=UDP SPT=4608 8 DPT=13298 LEN=114 ]

Here, "my-public-ip" is the external dynamic IP assigned to iface "wan" by the ISP. Another iface, "br0", is connected to my LAN.

If I am reading this correctly, then a host at (Russia, mts-nn.ru) sends me an ICMP host-unreachable message in reply to one of LAN machine's request for a

However this is very confusing for me, as in the FORWARD chain there is a rule which specifically blocks such requests (along with and from inside the LAN

    -A FORWARD -d -i br0 -j REJECT --reject-with icmp-host-unreachable

For example, traceroute returns the correct "!H"

    $ traceroute
    traceroute to (, 30 hops max, 60 byte packets
    1 (  2.534 ms  2.496 ms  2.499 ms
    2 (  2.535 ms !H  2.617 ms !H  2.637 ms !H

So, how do I make sense of the above log entry?


-A FORWARD -d -i br0 -j REJECT --reject-with icmp-host-unreachable doesn't block host unreachable requests, it generates them in response to certain conditions.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.