iptables and -j TTL dont work without enabling "Spoof LAN TTL value"

[Theliel]

Hi guys,

I don't know if is a bug or I do not understand something...
(Im using RT-AC56u with 384.5)

I was trying to set all outgoing TTL packets (with TTL less than 10) from specific host to a fixed new TTL, so my rule is:

iptables -t mangle -I PREROUTING -s 192.168.2.52 -m ttl --ttl-lt 10 -j TTL --ttl-set 64

In theory should work, but always throws me the same error:

"iptables: No chain/target/match by that name."

Now, I'd enabled "Spoof LAN TTL value" in WAN settings. Once that option is enabled, the previous rule is accepted perfectly and is working fine.

is "Spoof LAN TTL value" setting another parameter that allow us to use -j TTL??

 

[sfx2000]

The -m switch might be throwing you...

From the man page...

-m, --match match
Specifies a match to use, that is, an extension module that
tests for a specific property. The set of matches make up the
condition under which a target is invoked. Matches are evaluated
first to last as specified on the command line and work in
short-circuit fashion, i.e. if one extension yields false, eval‐
uation will stop.

 

[Theliel]

iptables -t mangle -I PREROUTING -s 192.168.2.52 -j TTL --ttl-set 64

dont work neither.

After enabling Spoof LAN TTL... all work.

 

[kfp]

After enabling Spoof LAN TTL... all work.

Probably because the TTL chain only exists after enabling that option?

 

[sfx2000]

What are you trying to do? What is the use case for doing this?

 

[ColinTaylor]

You need to do this first:

modprobe xt_HL
modprobe xt_hl

 

[Theliel]

You need to do this first:

modprobe xt_HL
modprobe xt_hl

Exactly!! both modules seem to be needed, added to firewall-start and all work fine now. Thank for the tip.


sfx2000, because my ISP IPTV Box send some packets with a extremely low TTL (between 2-5) , so some packatets were being discarded by the network

 

[sfx2000]

sfx2000, because my ISP IPTV Box send some packets with a extremely low TTL (between 2-5) , so some packatets were being discarded by the network

Cool...