4

For some kind of testing, I configured a Linux as a simple router (IP forwarding enabled, some routes and no iptables rules).

In the interface "A", I receive fragmented IP datagrams due to I have configured a low MTU in that link (700). The "B" interface has the default MTU (1500). If I capture traffic in both interfaces I can see that I receive the IP datagram fragmented in "A" interface, but in the "B" one I see that the datagram is reassembled.

Is there any Linux or interface configuration that allow the fragmented datagrams to be forwarded from "A" to "B" without being reassembled?

1 Answer 1

5

I don't think you can, at least not in the way you intend to. In order for netfilter to work, linux has to reassemble the packets before handling them of to netfilter (see here, section "Specifying Fragments", especially the part about the INPUT chain). Since routed packets always pass netfilter (see this nice flowchart), the packets will be reassembled.

5
  • _"If you are doing connection tracking or NAT". This is not the case as there are no iptables rules... you have to enable either of those with rules, so it's a bit of a puzzle.
    – sourcejedi
    Aug 23, 2016 at 16:15
  • Would this apply to a forwarded datagram? Is not my case, but the IP datagrams (fragmented or not) could "travel" from the origin IP to the destination via different routes, so the router could not have all the IP fragments to reassemble the original datagram... Aug 23, 2016 at 16:22
  • 2
    It depends. I think having the modules loaded is enough for reassembly to take place as nf_defrag_ipv4 simply registers a hook(NF_INET_PRE_ROUTING). Could you check if maybe the module got loaded and rmmod it?
    – maxf
    Aug 23, 2016 at 17:39
  • Ok, I need to edit the question because I forgot to mention an important detail that I thought that was not affecting to the behaviour: I'm using network namespaces. I have tested with two equivalent envirnoments, one using virtual machines and another one using network namespaces and the behaviour with VMs is the expected (IP fragments routed without being reassembled), and with network namespaces I get the IP fragments reassembled. Aug 25, 2016 at 8:59
  • Finally, @maxf is right. When iptables is running, even when there is no rules configured in any table, the kernel reassembles the IP datagrams. If I remove the modules related with iptables (nf_conntrack, iptables, nf_nat...) I got the expected behaviour. Thanks for pointing me in the right direction Aug 30, 2016 at 12:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .