blob: e5915b0626bd4c5cff3253a7ac4b5d20d1ba7262 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
mtu1280 - emulates serving via a low MTU IPv6 tunnel
----------------------------------------------------
This program is will generate ICMPv6 "Packet Too Big"
responses with an MTU of 1280. mtu1280 will connect to
a netfilter_queue socket, listening for packets; and
respond to all packets sent to that queue.
This is meant to be ran on a secondary IP for your host.
It is recommend that your primary IP is NOT used with
this technique in case of application failure.
To deploy, compile build and install. Copy
in one of the init or init.d scripts, and make sure
it is set for auto-start for your OS. An actual reboot
is recommended.
Once up and running, configure ip6tables to route
large packets destined to the desired IP to the netfilter queue.
Example rule:
```
guest% sudo ip6tables-save | grep NFQ
-A INPUT -d 2001:470:1f04:d63::2/128 -m length --length 1281:65535 -j -NFQUEUE --queue-num 1280
```
REQUIREMENTS
------------
RedHat:
* Please send me confirmed required packages. -- jfesler@gigo.com
* libnetfilter queue "developer" package
* ip6tables - and a way to automatically load ip6tables on startup
Ubuntu:
* build-essential
* libnetfilter-queue-dev
* ip6tables - and a way to automatically load ip6tables on startup
IPTABLES / IP6TABLES
--------------------
For reference, this is what jfesler does:
/etc/rc.local:
```
iptables-restore /etc/iptables/rules.v4
ip6tables-restore /etc/iptables/rules.v6
```
/etc/iptables/rules.v6 (simplified version, only includes mtu1280 rule)
```
# Generated by ip6tables-save v1.4.21 on Tue Feb 17 10:54:23 2015
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -d 2001:470:1f04:d63::2/128 -m length --length 1281:65535 -j NFQUEUE --queue-num 1280
COMMIT
```
LICENSE
-------
GPLv2, due to the duplicated code from Hararld Welte's
libnetfilter_queue-1.0.2/utils/nfqnl_test.c (included).
|
