[Shorewall-users] Neighbour table overflow

Tom Eastep
Mon, 28 Oct 2002 17:42:14 -0000

Adam Henry wrote:
> On Sun, Oct 27, 2002 at 04:20:21PM -0800, Tom Eastep wrote:
>
>>>| Oct 25 11:30:36 fw kernel: Shorewall:rfc1918:DROP:IN=Serial0
>>>| OUT= MAC= SRC=10.3.32.1 DST=209.176.91.56 LEN=56 TOS=0x00
PREC=0x00
>>>| TTL=241 ID=45499 PROTO=ICMP TYPE=3 CODE=1 [SRC=209.176.91.56
>>>| DST=68.97.0.94 LEN=84 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=ICMP
>>>| TYPE=8 CODE=0 ID=11895 SEQ=0 ]

Ok -- the above (with real IP substituted) is very similar to the packet
in the other thread. In this case, there was a ping from your firewall
(possibly SNAT/MASQUERADED) to 68.97.0.94. That host is behind a NAT
gateway so the destination was rewritten to 10.3.32.1. I suspect that
system has a rule against passing ping requests so it returned the rather
nonsensical response of "port not available" but did not change the
source
IP back to 68.97.0.94. Your firewall therefore barfed on the returning
ICMP because its source address was reserved by RFC 1918 (see
http://www.shorewall.net/FAQ.htm#faq17


>
>
>>I''ve never seen this problem personally (although I see it
reported quite
>>a bit on other lists) and I don''t recall anything about it.
>
>
> I have noticed quite a bit of activity searching through Groups on
> Google.  The most common fix I have heard suggested was to enable the
> local loopback interface, which has already been done.
>

The only thing I notice that is unusual about your setup is that you seem
to have some sort of WAN serial interface (correct?) - that might be relevant.

-Tom
--
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@shorewall.net