Re: need iptables rule to turn off ecn on a firewall
On Fri, 2 May 2003 03:23 pm, Hanasaki JiJi wrote:
> The internal network has ECN on. A few ports are NATed going out. Is
> there an iptables rule that will turn off ECN as ports are going out
> through the firewall?
Haven't actually done this myself, but it's definitely possible according to
the iptables man page :
This target allows to selectively work around known ECN blackholes. It
can only be used in the mangle table.
Remove all ECN bits from the TCP header. Of course, it can only
be used in conjunction with -p tcp.
iptables -t mangle -I FORWARD -o $EXTERNAL_INTERFACE -p tcp --ecn-tcp-remove
(untested, but looks right to me)
GPG : http://n12turbo.com/tarragon/public.key