Redirect pings from WAN to internal network for router to respond?

[ml70]

Would this be enough or will it go wrong somewhere, because my wan ip's are dhcp i'd need something like a reverse masquerade:

iptables -t nat -A PREROUTING -p icmp -i ! br0 -d 192.168.0.0/16 --icmp-type echo-request -j DNAT --to 127.0.0.1

Or should i make an active script which gets wan_ipaddr from nvram and fills it into the rule instead of localhost.

Or maybe the actual solution is something different? I thought about using this for incoming icmp 5, 8, 13, 15, 17, 30. Maybe other stuff too if it works well, to keep the internal network completely nonvisible from the isp's 10.x.x.x network my router is connected to.

It's hard to test this because i can't have myself pinged from the isp network, and iptables counters are still at zero.

 

[ColinTaylor]

I really don't understand what you are trying to achieve here.

icmp pings aren't forwarded to your LAN (unless you've manually created an iptables rule). If someone, even your ISP, pings your WAN address they're only hitting your router not anything on your LAN.

 

[ml70]

I was thinking about icmp messages with source routing, someone on the same internal network (10.0.0.0/8) who tries to find out more about my network could randomly poke my 10.0.1.100 address with source routing pointing to private network address space and wait for replies.

And in order to avoid this, dnat all/some icmp messages coming from wan with destination in private address space to the router instead.

 

[ColinTaylor]

Hi ml70,

I wasn't aware that was possible with IP so thanks for educating me

I've had a quick google about it and it looks like the way to deal with it would be with kernel tuning. i.e.

# echo 0 > /proc/sys/net/ipv4/conf/eth0/accept_source_route

I'll have to read up some more on this...

Maybe have a look at this: https://access.redhat.com/documenta...e-Server_Security-Disable-Source-Routing.html

 

[ml70]

Weird, yesterday when i checked /proc/sys/net/ipv4/conf/default/accept_source_route it was 0, indicating source routing is disabled, and i thought it's the default and didn't pursue this issue further (my rules had received 0 hits).

But today after reboot, it shows 1...

Edit: oopss seems i got confused between /default and /all, accept_redirects and accept_source_route are luckily disabled in /all.