What's new

iptables and -j TTL dont work without enabling "Spoof LAN TTL value"

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Theliel

Regular Contributor
Hi guys,

I don't know if is a bug or I do not understand something...
(Im using RT-AC56u with 384.5)

I was trying to set all outgoing TTL packets (with TTL less than 10) from specific host to a fixed new TTL, so my rule is:

iptables -t mangle -I PREROUTING -s 192.168.2.52 -m ttl --ttl-lt 10 -j TTL --ttl-set 64

In theory should work, but always throws me the same error:

"iptables: No chain/target/match by that name."

Now, I'd enabled "Spoof LAN TTL value" in WAN settings. Once that option is enabled, the previous rule is accepted perfectly and is working fine.

is "Spoof LAN TTL value" setting another parameter that allow us to use -j TTL??
 
The -m switch might be throwing you...

From the man page...

-m, --match match
Specifies a match to use, that is, an extension module that
tests for a specific property. The set of matches make up the
condition under which a target is invoked. Matches are evaluated
first to last as specified on the command line and work in
short-circuit fashion, i.e. if one extension yields false, eval‐
uation will stop.
 
iptables -t mangle -I PREROUTING -s 192.168.2.52 -j TTL --ttl-set 64

dont work neither.

After enabling Spoof LAN TTL... all work.
 
What are you trying to do? What is the use case for doing this?
 
You need to do this first:

modprobe xt_HL
modprobe xt_hl


Exactly!! both modules seem to be needed, added to firewall-start and all work fine now. Thank for the tip.


sfx2000, because my ISP IPTV Box send some packets with a extremely low TTL (between 2-5) , so some packatets were being discarded by the network
 

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top