Date: Tue, 22 Apr 2014 21:38:14 +0100 From: Nikolay Denev <nike_d@cytexbg.com> To: Harald Schmalzbauer <h.schmalzbauer@omnilan.de> Cc: "freebsd-net@freebsd.org" <freebsd-net@freebsd.org>, FreeBSD <freebsd-stable@freebsd.org> Subject: Re: Deleting IPv4 iface-routes from extra FIBs Message-ID: <CA%2BP_MZH_iScuJ4S=xiKocnEwTzT1eRJPNpJKbboZDfG3B=TBzA@mail.gmail.com> In-Reply-To: <53569ABA.60007@omnilan.de> References: <53569ABA.60007@omnilan.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Apr 22, 2014 at 5:37 PM, Harald Schmalzbauer <h.schmalzbauer@omnilan.de> wrote: > Hello, > > here, http://svnweb.freebsd.org/base?view=revision&revision=248895 > interface route protection was added (so the following problem arose > with 9.2). > > Unfortunately, in my case, I must be able to delete these routes; not in > the default FIB, but in jail's fibs, because: > · Host is multihomed with multiple nics in different subnets. > · Jail's IP (no vnet) is from a different subnet than host's > default-router subnet – jail has no ip in the range of host's > default-router!!! > · FIB used by jail contains valid default-router. > > Problem: > If iface-routes exist in jail's FIB, answer-packets take the > iface-shortcut, not trespassing the router (default gateway); hence > 3way-handshake never finishes and firewall terminates (half-opened) TCP > sessions. > > Workarround: > · Abuse packet filter doing some kind of route-to… > · Revert r248895, to be able to delete v4-iface-routes (inet6-routes can > be deleted without any hack) > > Desired solution: > · Allow deletion of v4-iface-routes if FIB!=0. > > Unfortunately my C skills don't allow me to implement this myself :-( > I can't even follow the code, I guess that was originally considered, > but possibly doesn't work bacause of a simple bug?!? I took the lazy way > and simply reverted r248895 instead of trying to understand > rtrequest1_fib(). I wish I had the time to learn… > > Thanks for any help, > > -Harry > Hi, As it was suggested before as immediate workaround you can set net.add_addr_allfibs=0 so that the interface routes are added only in the default FIB. --Nikolay
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CA%2BP_MZH_iScuJ4S=xiKocnEwTzT1eRJPNpJKbboZDfG3B=TBzA>