Outgoing packets being sent via wrong interface

[Kevin Oberman]

On Wed, Nov 25, 2015 at 5:16 AM, Daniel Bilik <ddb at neosystem.org> wrote:

> On Wed, 25 Nov 2015 12:20:33 +0000
> Gary Palmer <gpalmer at freebsd.org> wrote:
>
> > When the problem happens, what does the output of
> > route -n get <unreachable IP>
> > show?
>
> I'll check this next time it happens. Thanks for the tip. Right now it
> seems correct:
>
>    route to: 192.168.2.33
> destination: 192.168.2.0
>        mask: 255.255.255.0
>         fib: 0
>   interface: re1
>       flags: <UP,DONE,PINNED>
>  recvpipe  sendpipe  ssthresh  rtt,msec    mtu        weight    expire
>        0         0         0         0      1500         1         0
>
> >  It would also be worth checking the arp table.
>
> Yes, checking arp table was one of the first things I did when analyzing
> the problem. All arp entries seem correct, and do not change
> before-during-after the problem. I've also tried to manually remove arp
> entry for affected address (ie. forcing it to be refreshed), but it
> does not help.
>
> --
>                                                 Dan


Have you looked for ICMP redirect traffic? Does your firewall allow them?
If so, could you try adding a rule to block them? I can't provide a sample
rule as I don't use pf, but you want to block ICMP type 5 messages.

For a good overview of redirects, see either Wikipedia
<https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#Redirect>
or Cisco
<http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13714-43.html>
articles (or Google for many others).
--
Kevin Oberman, Part time kid herder and retired Network Engineer
E-mail: rkoberman at gmail.com
PGP Fingerprint: D03FB98AFA78E3B78C1694B318AB39EF1B055683