Article View: bit.listserv.openbsd-pf
Article #156Re: forwarding loop
From: Daniel Hartmeier
Date: Tue, 15 Jan 2013 19:30
Date: Tue, 15 Jan 2013 19:30
30 lines
2738 bytes
2738 bytes
On Tue, Jan 15, 2013 at 09:46:37AM -0600, Karl O. Pinc wrote: > Something that's not mentioned that > comes to mind is ICMP redirection. (Without thinking > about it a lot it seems like it should be a good candidate.) > However when I tried ICMP redirection on OpenBSD > years ago I couldn't get it to work. Never looked to see why, > or whether it's been fixed since. Or, I might have been doing > something wrong. If anyone can send a clue my way > I'd appreciate knowing more. An ICMP redirect, if it is honored by a client, does not mean "if you want to talk to external-server, connect to proxy-on-local-network instead", but "if you want to reach external-server, route through next-hop-on-local-network". The difference is that the reaction will not change the destination IP address, but the destination MAC address. Its really the same as if you added a temporary host route on the client. The proxy will simply ignore the IP packet for a foreign IP address sent to its MAC address (like a default gateway that has IP forwarding disabled). OpenBSD ignores ICMP redirects by default, you can enable it with sysctl net.inet.icmp.rediraccept, if you want to try. The security risk is that someone on the local network could send you ICMP redirects for various destinations (like DNS server), for a man-in-the-middle attack. Daniel
Technical Details
Message-ID:
<20130115192550.GE2410@insomnia.benzedrine.cx>Path:
arc1-ca.pugleaf.net!s9ni7494pbb.0!nntp.google.com!border1.nntp.dca.giganews.com!border4.nntp.dca.giganews.com!border2.nntp.dca.giganews.com!novia!news-peer1!btnet!zen.net.uk!hamilton.zen.co.uk!xlned.com!feeder1.xlned.com!npeer.de.kpn-eurorings.net!npeer-ng0.de.kpn-eurorings.net!border2.nntp.ams2.giganews.com!border4.nntp.ams.giganews.com!border2.nntp.ams.giganews.com!nntp.giganews.com!news.nobody.at!news.glorb.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrnReferences:
<20130115101033.GA2410@insomnia.benzedrine.cx> <1358264797.8274.1@mofo>Show Full Headers
Complete Article Headers
X-Google-Thread: bffa70e3,65dda175aebfa248
X-Google-Attributes: gidbffa70e3,public,usenet
X-Google-NewGroupId: yes
X-Google-Language: ENGLISH,ASCII-7-bit
X-Received: by 10.66.86.129 with SMTP id p1mr2117406paz.24.1358653600094;
Sat, 19 Jan 2013 19:46:40 -0800 (PST)
Path: arc1-ca.pugleaf.net!s9ni7494pbb.0!nntp.google.com!border1.nntp.dca.giganews.com!border4.nntp.dca.giganews.com!border2.nntp.dca.giganews.com!novia!news-peer1!btnet!zen.net.uk!hamilton.zen.co.uk!xlned.com!feeder1.xlned.com!npeer.de.kpn-eurorings.net!npeer-ng0.de.kpn-eurorings.net!border2.nntp.ams2.giganews.com!border4.nntp.ams.giganews.com!border2.nntp.ams.giganews.com!nntp.giganews.com!news.nobody.at!news.glorb.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn
From: daniel@benzedrine.cx (Daniel Hartmeier)
Newsgroups: bit.listserv.openbsd-pf
Subject: Re: forwarding loop
Date: 15 Jan 2013 11:30:45 -0800
Organization: None
Lines: 30
Message-ID: <20130115192550.GE2410@insomnia.benzedrine.cx>
References: <20130115101033.GA2410@insomnia.benzedrine.cx>
<1358264797.8274.1@mofo>
NNTP-Posting-Host: localhost.newsguy.com
Mime-Version: 1.0
NNTP-Posting-Date: 15 Jan 2013 19:30:46 GMT
X-Received-Bytes: 1970
Bytes: 2342
X-Original-Bytes: 2148
Content-Type: text/plain; charset=us-ascii