search for: hoplimit

...blem with ipv6, looks like its bridge routing problem but stuck. here are my bridge detail: bridge name bridge id STP enabled interfaces br0 8000.000af75613f2 no eth1 vnet1 br4 8000.000af75613f0 no eth0 ip -6 route shows : unreachable ::/96 dev lo metric 1024 error -101 mtu 65536 advmss 65476 hoplimit 4294967295 unreachable ::ffff:0.0.0.0/96 dev lo metric 1024 error -101 mtu 65536 advmss 65476 hoplimit 4294967295 unreachable 2002:a00::/24 dev lo metric 1024 error -101 mtu 65536 advmss 65476 hoplimit 4294967295 unreachable 2002:7f00::/24 dev lo metric 1024 error -101 mtu 65536 advmss 65476...

https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=448 laforge@netfilter.org changed: What |Removed |Added ---------------------------------------------------------------------------- Component|ip_conntrack |nf_conntrack ------- Additional Comments From laforge@netfilter.org 2006-02-14 09:05 MET ------- ipv6 conntrack is

...1 dev eth1 weight 1 nexthop via 192.168.254.254 dev eth2 weight 1 The problem is that load balancing isnt''t working :-/ root@enrutizador:~# for x in $(seq 1 10); do ip r g 130.206.1.$x; done 130.206.1.1 via 192.168.1.1 dev eth1 src 192.168.1.128 cache mtu 1500 advmss 1460 hoplimit 64 130.206.1.2 via 192.168.1.1 dev eth1 src 192.168.1.128 cache mtu 1500 advmss 1460 hoplimit 64 130.206.1.3 via 192.168.1.1 dev eth1 src 192.168.1.128 cache mtu 1500 advmss 1460 hoplimit 64 130.206.1.4 via 192.168.1.1 dev eth1 src 192.168.1.128 cache mtu 1500 advmss 1460 hoplimit...

...UT= MAC= SRC=192.168.254.39 DST=224.0.0.251 LEN=161 TOS=0x00 PREC=0x00 TTL=255 ID=39413 DF PROTO=UDP SPT=5353 DPT=5353 LEN=141 Feb 4 10:04:02 radio kernel: [ 553.992620] [UFW AUDIT] IN= OUT=enp2s5 SRC=fe80:0000:0000:0000:368d:74dd:abec:eba0 DST=ff02:0000:0000:0000:0000:0000:0000:00fb LEN=181 TC=0 HOPLIMIT=255 FLOWLBL=910431 PROTO=UDP SPT=5353 DPT=5353 LEN=141 Feb 4 10:04:02 radio kernel: [ 553.992633] [UFW ALLOW] IN= OUT=enp2s5 SRC=fe80:0000:0000:0000:368d:74dd:abec:eba0 DST=ff02:0000:0000:0000:0000:0000:0000:00fb LEN=181 TC=0 HOPLIMIT=255 FLOWLBL=910431 PROTO=UDP SPT=5353 DPT=5353 LEN=141 Feb 4...

...qualize nexthop via 192.168.254.254 dev eth2 weight 1 nexthop via 192.168.1.1 dev eth1 weight 1 The problem like sawar... root@enrutizador:~# for x in $(seq 1 10); do ip r g 130.206.1.$x; done 130.206.1.1 via 192.168.1.1 dev eth1 src 192.168.1.128 cache mtu 1500 advmss 1460 hoplimit 64 130.206.1.2 via 192.168.1.1 dev eth1 src 192.168.254.128 cache mtu 1500 advmss 1460 hoplimit 64 130.206.1.3 via 192.168.1.1 dev eth1 src 192.168.254.128 cache mtu 1500 advmss 1460 hoplimit 64 130.206.1.4 via 192.168.1.1 dev eth1 src 192.168.1.128 cache mtu 1500 advmss 1460 hopl...

...ROP ip6tables -A INPUT -p ICMPv6 -g input_icmpv6_packets After that, I got such lines in my log: Nov 16 14:57:42 yam kernel: ICMPv6 pkt: IN=eth1 OUT= MAC=33:33:ff:f9:89:a2:00:e0:4c:9f:0a:24:86:dd SRC=fe80:0000:0000:0000:1de5:d64e:a530:2977 DST=ff02:0000:0000:0000:0000:0001:fff9:89a2 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=135 CODE=0 Nov 16 14:57:43 yam kernel: ICMPv6 pkt: IN=eth1 OUT= MAC=00:22:15:f9:89:a2:00:e0:4c:9f:0a:24:86:dd SRC=fe80:0000:0000:0000:1de5:d64e:a530:2977 DST=fe80:0000:0000:0000:0222:15ff:fef9:89a2 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 Nov...

...168.3.1 dev eth6 weight 1 root@server1:/backup/ftp# ip ro show cache | egrep ''eth4|eth5|eth6'' -B1 | tail -n20 201.216.128.100 from 192.168.90.5 via 192.168.3.1 dev eth6 src 192.168.90.1 -- 192.168.90.5 from 201.240.149.1 dev eth2 src 192.168.1.2 cache mtu 1500 advmss 1460 hoplimit 64 iif eth5 -- cache <src-direct> mtu 1500 advmss 1460 hoplimit 64 iif eth2 200.114.138.45 from 192.168.90.5 via 192.168.1.1 dev eth4 src 192.168.90.1 -- 192.168.90.5 from 200.74.39.52 dev eth2 src 192.168.1.2 cache mtu 1500 advmss 1460 hoplimit 64 iif eth5 71.80.214.141 from 192....

...uot;f000" In log file /var/log/firewall in OpenSUSE11.1. The log for one connection request is 117 Aug 28 20:01:46 alpine5 kernel: f000IN=eth0 OUT= MAC=00:21:5e:4e:9c:60:00:25:90:10:86:8d:86:dd SRC=fe80:0000:0000:0000:e91b:befe:97dc:9df5 DST=fe80:0000:0000:0000:0221:5eff:fe4e:9c60 LEN=72 TC=0 HOPLIMIT =128 FLOWLBL=0 PROTO=TCP SPT=59113 DPT=21 WINDOW=8192 RES=0x00 SYN URGP=0. 118 Aug 28 20:01:46 alpine5 kernel: e000IN=eth0 OUT= MAC=00:21:5e:4e:9c:60:00:25:90:10:86:8d:86:dd SRC=fe80:0000:0000:0000:e91b:befe:97dc:9df5 DST=fe80:0000:0000:0000:0221:5eff:fe4e:9c60 LEN=72 TC=0 HOPLIMIT =128 FLOWL...

...nication I want. What I''m getting in my logs is (I''ve logged the ACCEPT rule for clarity): Dec 4 16:11:19 xxxx kernel: [67682.239124] Shorewall:int2dmz:ACCEPT:IN=br1 OUT=br0 SRC=xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx DST=xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx LEN=1496 TC=0 HOPLIMIT=63 FLOWLBL=0 FRAG:0 INCOMPLETE ID:56a39152 PROTO=UDP SPT=37801 DPT=25826 LEN=1905 Dec 4 16:11:19 xxxx kernel: [67682.239148] Shorewall:int2dmz:REJECT:IN=br1 OUT=br0 SRC=xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx DST=xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx LEN=505 TC=0 HOPLIMIT=63 FLOWLBL=0 FRAG...

...om 2a00:1450:4016:800::1013: icmp_seq=0 ttl=57 time=91.2 ms 64 bytes from 2a00:1450:4016:800::1013: icmp_seq=1 ttl=57 time=95.3 ms These are the routing table entries added by my hand-added configuration: 2000::/3 via 2a02:418:6a04::1 dev eth0 metric 1 expires 21333054sec mtu 1500 advmss 1440 hoplimit 4294967295 default dev eth0 metric 1 expires 21333054sec mtu 1500 advmss 1440 hoplimit 4294967295 So... given the parameters set in my config files, why are the CentOS v5.8 initscripts not configuring my IPv6 routing correctly? One more thing. I get this output on network start up (prior to...

...n 0.5.0 (3420 buckets, 13680 max) [ 25.688528] ip_tables: (C) 2000-2006 Netfilter Core Team [ 28.201103] NET: Registered protocol family 17 [ 33.914653] SFW2-INext-DROP-DEFLT IN=eth0 OUT= MAC= SRC=fe80:0000:0000:0000:0213:8fff:fe78:2b50 DST=ff02:0000:0000:0000:0000:0000:0000:00fb LEN=456 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=UDP SPT=5353 DPT=5353 LEN=416 [ 46.282711] SFW2-INext-DROP-DEFLT IN=eth0 OUT= MAC= SRC=fe80:0000:0000:0000:0213:8fff:fe78:2b50 DST=ff02:0000:0000:0000:0000:0000:0000:00fb LEN=84 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=UDP SPT=5353 DPT=5353 LEN=44 [ 47.284429] SFW2-INext-DROP-DEF...

...tch-o-matic. I can test without these patches if needed. Here is a snippet of a log; 7N means outgoing NEW packet and 6I means incoming INVALID packet. Feb 13 16:48:15 gamma kernel: 7N IN= OUT=tun6 SRC=2002:4071:4c37:0000:0000:0000:0000:0001 DST=2001:1418:0013:0001:0000:0000:0000:0025 LEN=72 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=TCP SPT=55560 DPT=6667 SEQ=2855237330 ACK=2296150387 WINDOW=16736 RES=0x00 ACK URGP=0 OPT (0101080A000A3B4F1834B2D1) UID=1001 Feb 13 16:48:15 gamma kernel: 6I IN=tun6 OUT= MAC=00:02:b3:5f:61:e8:00:05:dc:1f:3f:fc:08:00:45:00:00:df:29:d6:00:00:ef:29:3c:6c:d5:fe:02:0d:40:71:4c:37:60...

...s them. ( so far Router Solicitations, Neighbor Solicitations and Neighbor Advertisements and maybe other packages too ) ip6tables-INVALID: IN=eth0 OUT= MAC=33:33:00:00:00:02:00:13:77:ae:f2:1f:86:dd SRC=fe80:0000:0000:0000:0213:77ff:feae:f21f DST=ff02:0000:0000:0000:0000:0000:0000:0002 LEN=56 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=133 CODE=0 ip6tables-INVALID: IN=eth0 OUT= MAC=00:10:e0:02:22:02:00:13:77:ae:f2:1f:86:dd SRC=2001:06f8:10bb:0000:0213:77ff:feae:f21f DST=fe80:0000:0000:0000:0210:e0ff:fe02:2202 LEN=72 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=136 CODE=0 ip6tables-INVALID: IN=eth...

https://bugzilla.netfilter.org/show_bug.cgi?id=918 Summary: Ranges and comparat Product: nftables Version: unspecified Platform: x86_64 OS/Version: Debian GNU/Linux Status: NEW Severity: normal Priority: P5 Component: nft AssignedTo: pablo at netfilter.org ReportedBy: anarey at gmail.com

...0:00:7c:ac:f0:00:00:16:29:e3:52:a3:a2:aa:b1:50:68:75:5a:60:00:00:00:00:40:3a:3a:20:01:0b:40:0d:ea:00:12:00:01:00:01:00:01:00:01:20:01:06:b8:00:00:06:00:00:00 TUNNEL=163.162.170.177->80.104.117.90 SRC=2001:0b40:0dea:0012:0001:0001:0001:0001 DST=2001:06b8:0000:0600:0000:0000:0000:2046 LEN=104 TC=0 HOPLIMIT=58 FLOWLBL=0 PROTO=ICMPv6 TYPE=129 CODE=0 ID=46889 SEQ=1 Sep 13 10:27:33 eddie inv: IN=sit0 OUT= MAC=80:01:75:00:00:00:b6:00:91:00:00:00:00:21:45:00:00:7c:ad:0f:00:00:16:29:e3:33:a3:a2:aa:b1:50:68:75:5a:60:00:00:00:00:40:3a:3a:20:01:0b:40:0d:ea:00:12:00:01:00:01:00:01:00:01:20:01:06:b8:00:00:06:00:...

...25:48 proxy-comcast-2 NetworkManager[541]: <error> [1424877948.384918] [rdisc/nm-lndp-rdisc.c:241] send_rs(): ([snip]): cannot send router solicitation: -1. Feb 25 10:25:48 proxy-comcast-2 kernel: OUT-world:IN= OUT=[snip] SRC=fe80:[snip] DST=ff02:0000:0000:0000:0000:0000:0000:0002 LEN=48 TC=0 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=133 CODE=0 -- :wq

...line, however filtering vlan frames is dropping ICMPv6 type 134, the counter increases and the log exhibits: nd et DROPIN=eth2 OUT= MACSRC=78:ba:f9:73:f5:74 MACDST=33:33:00:00:00:01 MACPROTO=86dd SRC=fe80:0000:0000:0000:7aba:f9ff:fe73:f574 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=224 HOPLIMIT=255 FLOWLBL=0 PROTO=ICMPv6 TYPE=134 CODE=0 -- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200923/b7b24f82/attachment.h...

....15 DST=192.168.254.39 LEN=90 TOS=0x00 PREC=0x00 TTL=128 ID=10653 PROTO=UDP SPT=137 DPT=50482 LEN=70 Jan 28 10:05:57 martin-RB042AV-ABA-a1410y kernel: [ 39.099157] [UFW BLOCK] IN=enp2s5 OUT= MAC= SRC=fe80:0000:0000:0000:368d:74dd:abec:eba0 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=64 TC=0 HOPLIMIT=1 FLOWLBL=849527 PROTO=UDP SPT=8612 DPT=8612 LEN=24 Jan 28 10:05:57 martin-RB042AV-ABA-a1410y kernel: [ 39.099223] [UFW BLOCK] IN=enp2s5 OUT= MAC= SRC=fe80:0000:0000:0000:368d:74dd:abec:eba0 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=64 TC=0 HOPLIMIT=1 FLOWLBL=871986 PROTO=UDP SPT=8612 DPT...

...t network (service network restart) I get: Bringing up interface eth0: WARN : [ipv6_add_route] Unknown error [ OK ] and ip -6 route show dev eth0 generates: 2607:f4b8:3:1::/64 metric 256 expires 21333899sec mtu 1500 advmss 1440 hoplimit 4294967295 fe80::/64 metric 256 expires 21333899sec mtu 1500 advmss 1440 hoplimit 4294967295 What is missing? I am using http://www.tldp.org/HOWTO/Linux+IPv6-HOWTO/ for some help.

...ook into these packets, there is another icmp redirect with : 0.0.0.0 -> 0.0.0.0 i''ve check many things, the most imports: # ip r g 152.66.235.8 from 157.181.96.1 iif eth0 152.66.235.8 from 157.181.96.1 dev eth0 src 10.0.0.2 cache <src-direct,redirect> mtu 1500 advmss 1460 hoplimit 64 iif eth0 # ip r g 152.66.235.1 152.66.235.1 dev eth0 src 10.0.0.2 cache mtu 1500 advmss 1460 hoplimit 64 i think it should work... our firewall is acting as an arp-proxy on our network, it does some packet filtering and traffic accounting, nothing unusual it runs 2.6.11.8, on another mac...