>Routers and other things that pass packets through them, by design, >are not meant to defragment packets.
They're not even allowed to. >In the worst case scenario, e,g, UDP NFS, you could be reassembling >8k packets only to defragment them again as they exit the firewall. > >That's a huge performance hit. Or 64K packets. If all the host software was known to be good and well-behaved when it came to reassembly and reassembly timeouts, you could, in principle, allow all fragments at offsets > 0 through the firewall. Of course, you'd pick a minimum offset with care; since the minimum guaranteed MTU is 536 (I think), you should do well to drop all packets with an offset > 0 and < 536. And then you'd apply your filtering rules to the initial fragment which should have a minimum length equal to the minimum offset you picked. Of course, you will need to know/verify that your TCP stacks behind the firewall won't sit on masses of IP fragments and can be DoSed. This leaves aside the question of NAT'ed packets; you can't redirect those unless you know where the first fragment went. You don't need to reassmble them, but you need to hold on to them until you know where to forward them to. I think they've changed Linux to be well-behaved now. Casper
