Re: IP Masq question in pre-2.0.31-1

Keith Owens (
Mon, 14 Jul 1997 21:00:30 +1000

On Mon, 14 Jul 1997 02:56:42 -0400 (EDT),
Jon Lewis <> wrote:
>Just out of curiosity, why is the code that prints things like:
>MASQ: forward ICMP: failed checksum from!
>MASQ: forward ICMP: failed checksum from!
>outside the ifdef's for CONFIG_IP_MASQUERADE_ICMP. i.e. I don't have
>CONFIG_IP_MASQUERADE_ICMP set in this kernel though I do have
>CONFIG_IP_MASQUERADE, yet am seeing the above on a multi-ether linux
>router. Is there a good reason not obvious to me, or is it an oversight?

Standard masq has to support ICMP replies for outgoing TCP/UDP packets.
Otherwise masqed applications would not see things like "no route to
host" or "need to fragment" and would wait for a long time.
CONFIG_IP_MASQUERADE_ICMP lets masqed hosts do ping or traceroute. The
messages you are seeing are bad checksums on ICMP responses to outgoing