Can anyone tell me how do i allow ping or tracert from intranet pc to other urls behind firewall

i tried

/sbin/iptables -A INPUT -i eth0 -p icmp --icmp-type echo-reply -j ACCEPT

but i could be able to ping outside websites.

pudhi

add destination and source addresses to the iptables rule.
say your network is 192.168.0.*

then a command such as
iptables -A INPUT -i eth0 -p icmp --icmp-type echo-reply -s 192.168.0.0/24 -d 192.168.0.0/24 -j ACCEPT

will only accept ping packets from a machine on the private network that is destined for the private network.

hope that helps,
jpbarto

Thanks jobarto
I tried the same with sourceip and dest. ip address then from iptables-save i got the following ....
-A INPUT -s 192.168.1.0/255.255.255.0 -d 195.137.82.0/255.255.255.0 -i eth0 -p icmp -m icmp --icmp-type 0 -j ACCEPT
COMMIT

But after this also it is not ping ing from my pc to this destination ip address

could there be anyother checks?

pudhi

when i am trying to log the FORWARD i got this result, with this could you please tell me where i am going wrong?

2 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=6236 PROTO=TCP SPT=1723 DPT=2584 WINDOW=2
100 RES=0x00 ACK URGP=0
Dec 9 20:50:57 pink kernel: VPN-IN=eth0 OUT=eth1 SRC=194.173.82.49 DST=192.168.0.
2 LEN=188 TOS=0x00 PREC=0x00 TTL=241 ID=6237 PROTO=TCP SPT=1723 DPT=2584 WINDOW=
2100 RES=0x00 ACK PSH URGP=0
Dec 9 20:50:57 pink kernel: VPN-IN=eth1 OUT=eth0 SRC=192.168.0.2 DST=194.173.82.49
8 LEN=56 TOS=0x00 PREC=0x00 TTL=127 ID=13103 DF PROTO=TCP SPT=2584 DPT=1723 WIND
OW=65183 RES=0x00 ACK PSH URGP=0
Dec 9 20:50:58 pink kernel: VPN-IN=eth0 OUT=eth1 SRC=194.173.82.49 DST=192.168.0.
2 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=6238 PROTO=TCP SPT=1723 DPT=2584 WINDOW=2
084 RES=0x00 ACK URGP=0
Dec 9 20:50:58 pink kernel: VPN-IN=eth0 OUT=eth1 SRC=194.173.82.49 DST=192.168.0.
2 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=6239 PROTO=TCP SPT=1723 DPT=2584 WINDOW=2
100 RES=0x00 ACK URGP=0
Dec 9 20:50:58 pink kernel: VPN-IN=eth0 OUT=eth1 SRC=194.173.82.49 DST=192.168.0.
2 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=6240 PROTO=TCP SPT=1723 DPT=2584 WINDOW=2
100 RES=0x00 ACK FIN URGP=0
Dec 9 20:50:58 pink kernel: VPN-IN=eth1 OUT=eth0 SRC=192.168.0.2 DST=194.173.82.49
8 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=13105 DF PROTO=TCP SPT=2584 DPT=1723 WIND
OW=65183 RES=0x00 ACK FIN URGP=0
Dec 9 20:50:58 pink kernel: VPN-IN=eth0 OUT=eth1 SRC=194.173.82.49 DST=192.168.0.
2 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=6241 PROTO=TCP SPT=1723 DPT=2584 WINDOW=2
100 RES=0x00 ACK URGP=0


thanks
pudhi

if your IP is 192.168.1.* and you were pinging a machine on the 195.137.82.* network then about the best thing I could suggest would be to turn on logging in your IPtables so that you can see when a packet gets rejected why it was rejected.

iptables -A INPUT -m state --state INVALID,NEW -j LOG --log-prefix='iptables dropped: '

pudhi, if that output is coming from a log on the forward chain then I don't think the output will have anything to do with your INPUT chain.

If this firewall is on a router then the icmp rule we first started with will probably need to be applied to the forward chain and not the input (I think)

just so you have an idea of what order the chains are processed in here's a nice diagram:

http://www.linuxnetmag.com/share/issue9/iptables3.jpg

(ripped from this article)
http://www.linuxnetmag.com/en/issue9/m9iptables1.html

Hi jobarto

greetings to you

Now i tried with forward

the following is the result.

Dec 9 21:09:38 pink kernel: VPN-IN=eth1 OUT=eth0 SRC=192.168.0.2 DST=194.173.82.49
LEN=53 TOS=0x00 PREC=0x00 TTL=127 ID=18124 PROTO=47
Dec 9 21:09:38 pink kernel: VPN-IN=eth1 OUT=eth0 SRC=192.168.0.2 DST=194.173.82.49
LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=18125 PROTO=ICMP TYPE=8 CODE=0 ID=1280 SE
Q=8714
Dec 9 21:09:39 pink kernel: VPN-IN=eth1 OUT=eth0 SRC=192.168.0.2 DST=194.173.82.49
LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=18127 PROTO=ICMP TYPE=8 CODE=0 ID=1280 SE
Q=8970
Dec 9 21:09:39 pink kernel: VPN-IN=eth0 OUT=eth1 SRC=194.173.82.49 DST=192.168.0.
2 LEN=56 TOS=0x00 PREC=0x00 TTL=240 ID=6950 PROTO=TCP SPT=1723 DPT=2705 WINDOW=2
100 RES=0x00 ACK PSH URGP=0
Dec 9 21:09:39 pink kernel: VPN-IN=eth1 OUT=eth0 SRC=192.168.0.2 DST=194.173.82.49
LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=18129 DF PROTO=TCP SPT=2705 DPT=1723 WIND
OW=65331 RES=0x00 ACK PSH URGP=0
Dec 9 21:09:40 pink kernel: VPN-IN=eth0 OUT=eth1 SRC=194.173.82.49 DST=192.168.0.
2 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=6952 PROTO=TCP SPT=1723 DPT=2705 WINDOW=2
080 RES=0x00 ACK URGP=0

but still i could'nt be able to ping/

pudhi

pudhi, could this have anything to do with the packets coming in on eth1 or going out on eth1 as the rule you listed above is only applied to eth0...

I'll be the first to admit that I don't know much about iptables, just about enough to be dangerous... but could the packet now be getting blocked by some rule that is applied (or not applied) to eth1?

Thanks for the concern jobarto .

First of all i apologise from my side

sorry for the trouble.

When i am trying to ping my ISP Dns it is pinging properly. I think only those guys might have blocked all icmp requests.

If this is the case, then is it possible for me to connect to the VPN server situated outside of my network?


pudhi

I don't see why not, couldn't hurt to try though right?
for example, can't ping www.google.com, but you know its still there.

sometimes I think that the internet might come to a turtle's trot if google wasn't up and running.