Am Di, den 05.07.2005 schrieb Eric Wagar um 7:15: > What rule do I need to allow a certain network PING responses? This is > for my ISPs monitoring. Is it an INPUT or an OUTPUT? > eric INPUT: ICMP Echo Request OUPUT: ICMP Echo Reply This is if a remote host shall be able to ping you successfully. http://www.erg.abdn.ac.uk/users/gorry/course/inet-pages/icmp-code.html http://www.networksorcery.com/enp/protocol/icmp/msg8.htm http://www.networksorcery.com/enp/protocol/icmp/msg0.htm Example rules: -A INPUT -i ppp0 -s 1.2.3.4/32 -p icmp -m limit --limit 2/sec -m icmp --icmp-type 8 -j ACCEPT -A OUTPUT -o ppp0 -d 1.2.3.4/32 -p icmp -m limit --limit 2/sec -m icmp --icmp-type 0 -j ACCEPT If you want to be able to ping yourself, a reverse ordered rule must exist. *Warning* Do NOT block ICMP if you don't know for sure which types you block and what they are for! ICMP isn't a protocol you simply can cut off without loosing network reliability! You shoot yourself in the feet if you generally prohibit ICMP! Alexander -- Alexander Dalloz | Enger, Germany | GPG http://pgp.mit.edu 0xB366A773 legal statement: http://www.uni-x.org/legal.html Fedora Core 2 GNU/Linux on Athlon with kernel 2.6.11-1.35_FC2smp Serendipity 09:10:49 up 9 days, 16:02, load average: 0.82, 0.47, 0.24
Attachment:
signature.asc
Description: Dies ist ein digital signierter Nachrichtenteil
