ECN and websites, how to turn if off selectively

Hi,

I noticed that after compiling a recent kernel (made some changes to the
config file) I wasn't able to reach some websites, eg:
http://www.simpleware.co.uk/

After some extensive search (took a while since I wasn't sure exactly
where the problem is), I found out that the ECN option (echo 1 >
/proc/sys/net/ipv4/tcp_ecn) is still not treated well by some websites.
As soon as I turned ECN off in my firewall(echo 0 >
/proc/sys/net/ipv4/tcp_ecn), those sites were accessible.

So, till all the websites conform to this specification, will I have to
keep ECN turned off, or is there a way to selectively turn off ECN for
particular websites only?

I am using 2.4.22-i386 custom compiled kernel on Debian (Sarge).

thanks,
->HS
--
(Please remove all underscores from my email address to get the correct
one. Apologies for the inconvenience, but this is to reduce spam.)

On Sat, 13 Dec 2003 18:37:08 -0500, H. S. wrote:

> Hi,
>
> I noticed that after compiling a recent kernel (made some changes to the
> config file) I wasn't able to reach some websites, eg:
> http://www.simpleware.co.uk/
>
> After some extensive search (took a while since I wasn't sure exactly
> where the problem is), I found out that the ECN option (echo 1 >
> /proc/sys/net/ipv4/tcp_ecn) is still not treated well by some websites.
> As soon as I turned ECN off in my firewall(echo 0 >
> /proc/sys/net/ipv4/tcp_ecn), those sites were accessible.
>
> So, till all the websites conform to this specification, will I have to
> keep ECN turned off, or is there a way to selectively turn off ECN for
> particular websites only?
>
> I am using 2.4.22-i386 custom compiled kernel on Debian (Sarge).
>
> thanks,
> ->HS

Yes there is. Here is one way in my crude fashion. This assumes that the
ipt_ECN module exists.


############## start #################

#!/bin/bash
#
for IP in \
192.208.45.167 \
129.253.170.30 \
198.175.96.226 \
63.77.98.76 \
80.68.34.2 \
210.210.19.110 \
216.61.164.89 \
216.23.181.230 \
63.127.20.35 \
195.92.247.210 \
216.61.164.68 \
216.23.181.202 \
208.152.64.44 \
216.23.181.147 \
208.152.64.40 \
65.161.188.152 \
198.175.96.225 \
198.175.96.32 \
139.60.220.32 \
209.137.157.33 \
213.191.72.7 \
64.37.137.83
#
do

# first, flush
/sbin/iptables -t mangle -D POSTROUTING -p tcp \
-d $IP -j ECN --ecn-tcp-remove
# then, reload
/sbin/iptables -t mangle -A POSTROUTING -p tcp \
-d $IP -j ECN --ecn-tcp-remove


done

echo -n "Done loading the ECN list"
echo

########### end ###############