Community discussions

MikroTik App
 
Max
Member Candidate
Member Candidate
Topic Author
Posts: 116
Joined: Fri Jan 01, 2010 5:45 pm

TTL increment for incoming packets. What am I doing wrong?

Sun Apr 25, 2010 3:04 pm

This is the command that I've used. I'm still getting the expired TTL error.
/ip firewall mangle add action=change-ttl chain=postrouting disabled=no dst-address=. . . . / . new-ttl=increment:1
 
User avatar
janisk
MikroTik Support
MikroTik Support
Posts: 6263
Joined: Tue Feb 14, 2006 9:46 am
Location: Riga, Latvia

Re: TTL increment for incoming packets. What am I doing wron

Mon Apr 26, 2010 2:48 pm

if packet in prerouting is received with ttl=1 it is reduced to 0 and then dropped, if you want to receive further inside, you have to change chain to prerouting.
 
Max
Member Candidate
Member Candidate
Topic Author
Posts: 116
Joined: Fri Jan 01, 2010 5:45 pm

Re: TTL increment for incoming packets. What am I doing wron

Mon Apr 26, 2010 5:30 pm

I did the following:
firewall-mangle: action=change ttl, TTL action = increment, new value=1, general=chain=prerouting.

I still get the error TTL expired in transit when I ping the website.
I'm guessing that it expects certain ttl values otherwise the ISP drops the packets.
When I connect the PC directly to the ISP connection it works fine.

My RB450G is set to NAT for a few PCs behind it.

How can I figure out the TTL rules that I have to apply?
 
Max
Member Candidate
Member Candidate
Topic Author
Posts: 116
Joined: Fri Jan 01, 2010 5:45 pm

Re: TTL increment for incoming packets. What am I doing wron

Mon Apr 26, 2010 7:38 pm

I don't understand why does this happen. Why doesn't it ping with the specified TTL?

This is a ping originated from ether1(having the active IP address that I have from the ISP).
Ping-ing from here should react just like pinging from a PC that has the active IP address that I have from the ISP and it is directly connected to the ISP, right?
You do not have the required permissions to view the files attached to this post.
 
User avatar
skillful
Trainer
Trainer
Posts: 552
Joined: Wed Sep 06, 2006 1:42 pm
Location: Abuja, Nigeria
Contact:

Re: TTL increment for incoming packets. What am I doing wron

Mon Apr 26, 2010 8:50 pm

Please modify your mangle rule to include the in-interface. e.g.
/ip firewall mangle
add action=change-ttl chain=prerouting comment="" disabled=no in-interface=wan new-ttl=increment:1
replace "wan" with the actual name of the interface connected to the ISP
 
Max
Member Candidate
Member Candidate
Topic Author
Posts: 116
Joined: Fri Jan 01, 2010 5:45 pm

Re: TTL increment for incoming packets. What am I doing wron

Mon Apr 26, 2010 9:05 pm

I did that, and it doesn't work. It's very strange.
99% of the websites work without any TTL rule. This tracker is the first one that gives me this error.
[It worked 5 minutes ago, for a short period, with the postrouting ttl set to value 53. Now it gives me that expired ttl error again.]

Look what happens when I try to trace the route.
You do not have the required permissions to view the files attached to this post.

Who is online

Users browsing this forum: Nexius and 24 guests