Very Computer

by **ljj** » Sun, 08 Jul 2001 19:17:32

hi,all
I have a question about 'ping' work with netfilter.How can I
ban the icmp echo message out and still can send icmp request message
out and can recieve the icmp echo message at the same time.e.g.
I wish I can ping other computer which don't ban icmp echo,but I
also want my computer can't respond the 'ping' from others.I use
iptables.can I?
Thanks in Advance.

by **Luke Voge** » Sun, 08 Jul 2001 20:03:15

> hi,all
> I have a question about 'ping' work with netfilter.How can I
> ban the icmp echo message out and still can send icmp request message
> out and can recieve the icmp echo message at the same time.e.g.
> I wish I can ping other computer which don't ban icmp echo,but I
> also want my computer can't respond the 'ping' from others.I use
> iptables.can I?
> Thanks in Advance.

## LOG all pings. ##
$IPTABLES -A EXTERNAL-input -i $EXTERNAL -p icmp --icmp-type 8 -m limit
\
--limit 5/minute -j LOG --log-level 6 --log-prefix "PING "
## Then drop 'em
$IPTABLES -A EXTERNAL-input -i $EXTERNAL -p icmp --icmp-type 8 -j DROP

--
Regards
Luke
------
Q: What does FAQ stand for?
A: We are Frequently Asked this Question, and we have no idea.
------
PLEASE NOTE: Spamgard (tm) installed.

------

by **Tim Hayne** » Sun, 08 Jul 2001 21:46:38

> I have a question about 'ping' work with netfilter.How can I ban the
> icmp echo message out and still can send icmp request message out and can
> recieve the icmp echo message at the same time.e.g. I wish I can ping
> other computer which don't ban icmp echo,but I also want my computer
> can't respond the 'ping' from others.I use iptables.can I?

Works out of the box if you're using connection tracking. A pong is RELATED
to an outgoing ping request; OTOH an incoming ping is a NEW thing.

| iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
| iptables -A block -m state --state NEW -j DROP

or something like that - which you should really have in the first place :)

~Tim
--

|http://spodzone.org.uk/

by **mado** » Mon, 09 Jul 2001 00:30:07

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

> > I have a question about 'ping' work with netfilter.How can I ban the
> > icmp echo message out and still can send icmp request message out and
can
> > recieve the icmp echo message at the same time.e.g. I wish I can ping
> > other computer which don't ban icmp echo,but I also want my computer
> > can't respond the 'ping' from others.I use iptables.can I?

> Works out of the box if you're using connection tracking. A pong is
RELATED
> to an outgoing ping request; OTOH an incoming ping is a NEW thing.

> | iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
> | iptables -A block -m state --state NEW -j DROP

> or something like that - which you should really have in the first place
:)

> ~Tim
> --
> Gabrielle and Madelene were just dolls.

- Show quoted text -

Quote:> |http://spodzone.org.uk/

by **kimod** » Mon, 09 Jul 2001 01:48:05

ip tables is a good way to do this....but there are countless linux
firewalls that are capable of this...look on the net.

> hi,all
> I have a question about 'ping' work with netfilter.How can I
> ban the icmp echo message out and still can send icmp request message
> out and can recieve the icmp echo message at the same time.e.g.
> I wish I can ping other computer which don't ban icmp echo,but I
> also want my computer can't respond the 'ping' from others.I use
> iptables.can I?
> Thanks in Advance.

by **sver** » Mon, 09 Jul 2001 08:34:06

> ip tables is a good way to do this....but there are countless linux
> firewalls that are capable of this...look on the net.

>> hi,all
>> I have a question about 'ping' work with netfilter.How can I
>> ban the icmp echo message out and still can send icmp request message
>> out and can recieve the icmp echo message at the same time.e.g.
>> I wish I can ping other computer which don't ban icmp echo,but I
>> also want my computer can't respond the 'ping' from others.I use
>> iptables.can I?
>> Thanks in Advance.

configure your firewall to block incoming ICMP echo_requests (8) and
permit outgouing ICMP echo_requests and incoming ICMP echo_replies (0)

or, with 2.2, you can simply run
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

--

Very Computer

Can I prevent pinging from others and still ping others?

Can I prevent pinging from others and still ping others?

Can I prevent pinging from others and still ping others?

Can I prevent pinging from others and still ping others?

Can I prevent pinging from others and still ping others?

Can I prevent pinging from others and still ping others?

Can I prevent pinging from others and still ping others?