Since you marked it do-not-fragment, the router must discard the packet, as it can't fit in the hole, basically. Router 8 has the packet, and decides to forward the packet to router 9, but then finds that the DF (don't fragment) bit is set YES, and that the packet is larger than the MTU of the next hop (pkt=1500, mtu=1460).

The packet gets through routers 1-7 just fine. (this is an IP header field, not TCP or UDP, by the way)

Suppose the link between router 8-9 has MTU of 1460.Ī 1500-byte packet leaves client (guinnea pig packet if its a tool or otherwise deliberate MTU test) with the df-bit set to yes. Suppose you have a path with 12 routers between the client and server. This kind of situation is exactly what ICMP protocol is for - general-purpose messaging between nodes of the inter-network.

If a test application or a live application sends a don't-fragment packet that is too large for a particular hop along the path to its destination, then the discarding router is going to reply with an ICMP message. PMTU discovery is supposed to happen on every actual connection a host makes. It could even be a padded TCP/SYN packet - it really doesn't matter what the test packet is. They send them somewhere to see if they make it or not. These are basically 'guinnea pig' packets. UDP/5678 -> Neighbor Discovery Protocol, according to that page.Īnyway, some tools might send such packets. I would like to do the following -ġ) Allow ICMP requests originating from any host on my LAN to any other host on my LAN.Ģ) Allow ICMP requests originating from any host on my LAN out to the internet and back.ģ) Drop all ICMP requests not originating from my LAN (for example entering through the gateway)Ġ chain=input action=accept protocol=icmp src-address-list=LAN log=noĬhain=input action=drop connection-state=invalid log=no log-prefix=''Ĭhain=forward action=drop connection-state=invalid log=no log-prefix=''Ĭhain=input action=accept src-address-list=LAN log=no log-prefix=''Ĭhain=input action=accept connection-state=established log=noĬhain=input action=drop log=no log-prefix=''Ĭhain=forward action=accept connection-state=new src-address-list=LANĬhain=forward action=accept connection-state=related log=no log-prefix=''Ĭhain=forward action=accept connection-state=established log=noĬhain=forward action=drop log=no log-prefix=''ġ) Given the firewall rules I have in place does this seem like the best way to implement my ICMP rule?Ģ) Should any of my firewall rules be placed in a different order? I think I have this firewall ICMP rule configured correctly but want to ask others before I deploy it.

Ipv6 firewall mikrotik