allow incomming icmp request

sunlinux · 05-25-2009, 01:58 AM

using ip tables , I want a selected IP could ping my system.

rayfordj · 05-25-2009, 10:01 AM

Code:

iptables -I INPUT -p icmp -s 123.456.xxx.yyy -j ACCEPT
iptables -I INPUT 2 -p icmp -j DROP

man iptables
iptables -p icmp -h

anomie · 05-25-2009, 05:20 PM

I'd add that if you want to get even more specific, you can use:

Code:

-p icmp --icmp-type 8

ICMP type numbers

win32sux · 05-26-2009, 02:08 AM

You also might wanna specify that the packet should not be fragmented:

Code:

iptables -A INPUT -p ICMP --icmp-type 8 ! --fragment -s 123.123.123.123 -j ACCEPT

And perhaps you want to be even more specific than that by being stateful:

Code:

iptables -A INPUT -p ICMP --icmp-type 8 ! --fragment -s 123.123.123.123 \
-m state --state NEW -j ACCEPT

If you've got more than one network interface, you could specify which one this should apply to:

Code:

iptables -A INPUT -p ICMP -i eth0 --icmp-type 8 ! --fragment -s 123.123.123.123 \
-m state --state NEW -j ACCEPT

You're gonna need to deal with the echo reply packets too. If your OUTPUT chain is sending all packets in state ESTABLISHED to ACCEPT (or has an ACCEPT policy), then you're good to go. Otherwise, you could use either of these approaches:

Code:

iptables -A OUTPUT -p ICMP -o eth0 --icmp-type 0 -d 123.123.123.123 \
-m state --state ESTABLISHED -j ACCEPT

Code:

iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT

Generally speaking, the more specific you can be, the better.