3

I want to see how the routing table changes on a Linux system, when an ICMP redirect is received. For that I use

icmpush -v red -sp current-gateway -gw new-gateway -dest google.com -c host -prot tcp my-eth1-ip-address

(which returns success), but the result of

route -n 

remains the same. Of course I have checked the the output of

cat /proc/sys/net/ipv4/conf/eth1/accept_redirects

which is 1. This is an Ubuntu 12 machine, with the last stable version of kernel, no firewall installed.

So the question: what could be going wrong?

1
  • It might be that Linux only accepts redirects that were sent in reply to another packet, for security reasons. Jan 25, 2013 at 18:41

2 Answers 2

1

According to Documentation/networking/ip-sysctl.txt, by default redirects are only accepted for those gateways that are already listed in the routing table.

secure_redirects - BOOLEAN
    Accept ICMP redirect messages only for gateways,
    listed in default gateway list.
    secure_redirects for the interface will be enabled if at least one of
    conf/{all,interface}/secure_redirects is set to TRUE,
    it will be disabled otherwise
    default TRUE
0

An assumption: the call of icmpush does not use the external interface eth1, but rather the localhost one lo so that the kernel does not recognize that it is a correct redirect from the gateway. Besides, in very old versions of the linux kernel these routes were not displayed in the response of route -n. As I noted, the response of route -nC could be the correct way to include also the temporary redirect route.

@grawity, about accepting redirects that were sent in reply to another packet: did you read that somewhere? because I would be really interested in that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .