Re: Bridged ethernet with ipnat redirect to local port - getting ICMP redirects instead

[Thomas Bieg <tomsbsd%googlemail.com@localhost>]

Darren Reed wrote:
> First thing to try is to have the DHCP server include this line in
> dhcpd.conf:
>                  option wpad-url code 252 = text;
> and then add this to the dhcp definition for your TV:
>                  option wpad-url "http://192.168.1.1/wpad.dat";;
> with the appropriate data on your local web server in wpad.dat.
>
> Yes, that's just a proxy definition but I suspect that what you want
> to do is capture and control all WWW sessions from your TV andproxy
> is another way to do that. Be aware that it may default tousing port
> 443 and CONNECT if it is doing https.

DHCP is done by a blackbox device ATM, so I'd have to change that first,
but thanks for the tip!


> With respect to the ICMP redirect issue, I suspect that this is down
> to poor feature interaction in NetBSD and bridging. Somewhere the code
> is treating re0 and re1 as separate interfaces (and thus sending an
> ICMP redirect) when in fact they should be treated as one.
>
> This patch might help:
>
> --- sys/netinet/ip_input.c.orig  2012-12-04 07:58:30.000000000 +1100
> +++ sys/netinet/ip_input.c     2014-07-06 20:59:33.000000000 +1000
> @@ -1452,7 +1452,9 @@
>           */
>          dest.s_addr = 0;
>          if (!srcrt && V_ipsendredirects &&
> -           ia != NULL && ia->ia_ifp == m->m_pkthdr.rcvif) {
> +           ia != NULL && ia->ia_ifp == m->m_pkthdr.rcvif &&
> +           (ia->ia_ifp->if_bridge == NULL ||
> +           ia->ia_ifp->if_bridge != m->m_pkthdr.rcvif)) {
>                  struct sockaddr_in *sin;
>                  struct rtentry *rt;

I am a bit puzzled by that patch; the ip_input.c I have here as well as
the one in NetBSD-current seem to be quite different from yours.


Thanks,
Tom