In case of IPv4 we have net.ipv4.conf.all.send_redirects flag, but it's not available for IPv6. Is there anything better than this?

ip6tables -A OUTPUT -p icmpv6 --icmpv6-type redirect -j DROP

For some reason, Linux kernel wrongly assumes that IPsec ESP packets target the same network as the unencrypted one. For example, if a Linux box (acting as IPsec server) receives the packet from the network A directed to the VPN network B, and encrypted packet needs to be sent over the same network A, it tell the source host "Hey, the packet is directed to the network A, you are connected to the same network so you can send this packet youself" using ICMP Redirect packet. The kernel doesn't understand that sending encrypted packet to the network A is not the same as sending unencrypted packet to the network A.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.