0

I have two routers in the same subnet:

  • Linux server is a gateway to the Internet
  • Juniper SRX100H is for connection with other offices through IPsec VPN

All client machines have the Linux server as a default gateway. The Linux server has routes to other offices through the Juniper SRX. When a client machine tries to connect (ssh, rdp) to a computer in other office it receives the ICMP Redirect Message from the Linux host and sends some packets through the Juniper directly. Then it tries to send through the Linux gateway and receives ICMP Redirect Message again. The problem is that rdp and ssh sessions fail after some minutes. Also I noticed that this issue involves only Windows hosts. However, Cisco Phones (SIP) and SSH from Linux machines work fine.

The issue is also resolved on Windows computers if routes to the other offices' subnets are configured.

Is it possible not to configure routes on each Windows PCs and use only default Linux gateway?

Improve this question
1
  • 1
    It was my understanding that an ICMP redirect will cause a Windows client to add a static route to its routing table. It appears that this isn't happening. Have you looked at the routing table of a Windows client to see if a route does exist?
    – joeqwerty
    Jun 23, 2014 at 19:36

1 Answer 1

Reset to default
0

Turn off ICMP redirects:

sysctl net.ipv4.conf.all.send_redirects=0

(put that in /etc/sysctl.conf to make it permanent.)

ICMP redirects work well in theory but as you've found in practice they can be hit-and-miss.

Why, by the way, don't you just use that juniper as a router to the internet instead of a linux box?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.