Routing Question

RouterOS General
1

Hello:

I have a little problem that I hope someone can help me with.

What I am doing is using Router OS to switch between two vpn gateways on our network (providing multiple vpn failover using scripts which change static routes). The router is at x.x.x.125/25 and the gateways are at x.x.x.124/25 & .126/25 What is happening is : after the first connection is made from one host pc to another through the vpn, the router is bypassed by the host pc by an entry that appears in its route table (xp).
ie.
tracert x.x.x.131 ( which is at another location )
x.x.x.125
x.x.x.126
x.x.x.131

the next time I try:
tracert x.x.x.131
x.x.x.126
x.x.x.131

and a route is in the pc’s routing table bypassing the gateway
x.x.x.131 … x.x.x.126

I have tried other routers and this change ( in the host’s routing table) does not happen, but they lack netwatch and scripting capability. Does anyone know how I can stop this from happening?

Thank You
John

2

John

Sounds like an ICMP client redirect.

You can stop the client responding to these with a registry setting mentioned in this article (down at the very bottom):

http://www.microsoft.com/technet/technetmag/issues/2005/01/SessionHijacking/default.aspx

Alternatively, I suppose you could block the packet in the Output queue of the router.

Regards

Andrew

3

Thanks Andrew:

The registry patch mentioned in the article along with changing [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
“EnableICMPRedirect”=dword:00000000 will enable the failover circuits that I have in place. Now to find a way to make this router stop broadcasting them will be my next step.

john smids

4

John

ICMP types and codes are here:

http://www.iana.org/assignments/icmp-parameters

You’d need to filter in the output chain on the router. Something like

chain=output protocol=icmp icmp-options=5:0 action=drop

Regards


Andrew