Re: Firewall rule to allow a certain network ping responses

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Am Di, den 05.07.2005 schrieb Eric Wagar um 7:15:

> What rule do I need to allow a certain network PING responses?  This is 
> for my ISPs monitoring.  Is it an INPUT or an OUTPUT?

> eric

INPUT: ICMP Echo Request
OUPUT: ICMP Echo Reply

This is if a remote host shall be able to ping you successfully.

http://www.erg.abdn.ac.uk/users/gorry/course/inet-pages/icmp-code.html
http://www.networksorcery.com/enp/protocol/icmp/msg8.htm
http://www.networksorcery.com/enp/protocol/icmp/msg0.htm

Example rules:

-A INPUT -i ppp0 -s 1.2.3.4/32 -p icmp -m limit --limit 2/sec -m icmp
--icmp-type 8 -j ACCEPT
-A OUTPUT -o ppp0 -d 1.2.3.4/32 -p icmp -m limit --limit 2/sec -m icmp
--icmp-type 0 -j ACCEPT

If you want to be able to ping yourself, a reverse ordered rule must
exist.

*Warning* Do NOT block ICMP if you don't know for sure which types you
block and what they are for! ICMP isn't a protocol you simply can cut
off without loosing network reliability!
You shoot yourself in the feet if you generally prohibit ICMP!

Alexander


-- 
Alexander Dalloz | Enger, Germany | GPG http://pgp.mit.edu 0xB366A773
legal statement: http://www.uni-x.org/legal.html
Fedora Core 2 GNU/Linux on Athlon with kernel 2.6.11-1.35_FC2smp 
Serendipity 09:10:49 up 9 days, 16:02, load average: 0.82, 0.47, 0.24 

Attachment: signature.asc
Description: Dies ist ein digital signierter Nachrichtenteil


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux