Mailing List Archive: ping

ping

Aug 7, 2001, 2:37 PM

Post #1 of 4 (679 views)

Hi,

What should be turned on to enable ping ? Default policies are DROP and I've
set

iptables -A INPUT -p ICMP -s 0/0 --icmp-type 0 -j ACCEPT
iptables -A INPUT -p ICMP -s 0/0 --icmp-type 3 -j ACCEPT
iptables -A INPUT -p ICMP -s 0/0 --icmp-type 5 -j ACCEPT
iptables -A INPUT -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
iptables -A OUTPUT -p ALL -s 111.222.333 -j ACCEPT # 111.222.333 is the
real IPof the host
iptables -A OUTPUT -p ALL -s 127.0.0.1 -j ACCEPT

What am I missing?

TIA
Oyku

Re: ping [ In reply to ]

frank.moeller at gonicus

Aug 7, 2001, 5:28 AM

Post #2 of 4 (668 views)

Permalink

Hi,

> What should be turned on to enable ping ? Default policies are DROP and
> I've set
>
> iptables -A INPUT -p ICMP -s 0/0 --icmp-type 0 -j ACCEPT
> iptables -A INPUT -p ICMP -s 0/0 --icmp-type 3 -j ACCEPT
> iptables -A INPUT -p ICMP -s 0/0 --icmp-type 5 -j ACCEPT
> iptables -A INPUT -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
> iptables -A OUTPUT -p ALL -s 111.222.333 -j ACCEPT # 111.222.333 is the
> real IPof the host
> iptables -A OUTPUT -p ALL -s 127.0.0.1 -j ACCEPT
>
> What am I missing?

you should accept icmp echo-requests (icmp-type 8)
iptables -A INPUT -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT

Frank

RE: ping [ In reply to ]

N.Morse at hyperknowledge

Aug 7, 2001, 5:50 AM

Post #3 of 4 (670 views)

Permalink

>
> you should accept icmp echo-requests (icmp-type 8)
> iptables -A INPUT -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
>

Yeah, in fact for ping all you need is 0 (echo-reply) and 8 (echo request).
I also allow 11 and 3 and log any others but haven't found any problems yet
(but then I haven't been looking that hard at this area)

Re: ping [ In reply to ]

oykug at sbt

Aug 7, 2001, 6:58 PM

Post #4 of 4 (665 views)

Permalink

Thanks for the tip

----- Original Message -----
From: Nigel Morse <N.Morse@hyperknowledge.com>
To: <frank.moeller@gonicus.de>; Oyku Gencay <oykug@sbt.com.tr>
Cc: <netfilter@lists.samba.org>
Sent: Tuesday, August 07, 2001 5:50 AM
Subject: RE: ping

> >
> > you should accept icmp echo-requests (icmp-type 8)
> > iptables -A INPUT -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
> >
>
> Yeah, in fact for ping all you need is 0 (echo-reply) and 8 (echo
request).
> I also allow 11 and 3 and log any others but haven't found any problems
yet
> (but then I haven't been looking that hard at this area)