Doesn't NAT ICMP packets

[talex5]

Pings don't need to survive the NAT process. Is there any support for something like https://tools.ietf.org/html/rfc5508 ?

[yomimono]

Not sure what you mean by "pings don't need to survive the NAT process" - can you elaborate?

"Is there any support" - nope, but there should be. Thanks for bringing this RFC to my attention. Splitting the ICMP code out of mirage-tcpip's IPv4 module, like we did for ARP, would make handling ICMP as it specifies easier. As far as I can tell it should be possible, albeit potentially a bit redundant, to implement at least the error packet section within the current design of both mirage-tcpip and mirage-nat, though.

Is there a specific subset of the spec you need?

[talex5]

Sorry, typo; I meant "don't seem to survive".

I don't have any particular requirements - the more that works the better :-) It's for https://github.com/talex5/qubes-mirage-firewall (and any comments or suggestions about my use of mirage-nat are welcome!)

[talex5]

(this is implemented in #20)

[yomimono]

Thanks @talex5!