Page 1 of 1

TTL increment for incoming packets. What am I doing wrong?

Posted: Sun Apr 25, 2010 3:04 pm
by Max
This is the command that I've used. I'm still getting the expired TTL error.
/ip firewall mangle add action=change-ttl chain=postrouting disabled=no dst-address=. . . . / . new-ttl=increment:1

Re: TTL increment for incoming packets. What am I doing wron

Posted: Mon Apr 26, 2010 2:48 pm
by janisk
if packet in prerouting is received with ttl=1 it is reduced to 0 and then dropped, if you want to receive further inside, you have to change chain to prerouting.

Re: TTL increment for incoming packets. What am I doing wron

Posted: Mon Apr 26, 2010 5:30 pm
by Max
I did the following:
firewall-mangle: action=change ttl, TTL action = increment, new value=1, general=chain=prerouting.

I still get the error TTL expired in transit when I ping the website.
I'm guessing that it expects certain ttl values otherwise the ISP drops the packets.
When I connect the PC directly to the ISP connection it works fine.

My RB450G is set to NAT for a few PCs behind it.

How can I figure out the TTL rules that I have to apply?

Re: TTL increment for incoming packets. What am I doing wron

Posted: Mon Apr 26, 2010 7:38 pm
by Max
I don't understand why does this happen. Why doesn't it ping with the specified TTL?

This is a ping originated from ether1(having the active IP address that I have from the ISP).
Ping-ing from here should react just like pinging from a PC that has the active IP address that I have from the ISP and it is directly connected to the ISP, right?

Re: TTL increment for incoming packets. What am I doing wron

Posted: Mon Apr 26, 2010 8:50 pm
by skillful
Please modify your mangle rule to include the in-interface. e.g.
/ip firewall mangle
add action=change-ttl chain=prerouting comment="" disabled=no in-interface=wan new-ttl=increment:1
replace "wan" with the actual name of the interface connected to the ISP

Re: TTL increment for incoming packets. What am I doing wron

Posted: Mon Apr 26, 2010 9:05 pm
by Max
I did that, and it doesn't work. It's very strange.
99% of the websites work without any TTL rule. This tracker is the first one that gives me this error.
[It worked 5 minutes ago, for a short period, with the postrouting ttl set to value 53. Now it gives me that expired ttl error again.]

Look what happens when I try to trace the route.