[SOLVED] Iptables established connection

jaksis · 09-26-2013, 03:18 AM

Hello all.

I just want to understand a little bit more iptable rules.
So, I allowed all outgoing connections from server, blocked all incoming. I want to "dig" and "ping" from server, so I create rule

Quote:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Dig is working, but ping not. Why so?
When I create

Quote:

iptables -A INPUT -p icmp -j ACCEPT

ping is going to work too.

Thanks.

acid_kewpie · 09-26-2013, 05:30 AM

TBH I can't see anythign offhand to confirm it, but it just seems that ICMP isn't covered by the state module. You can filter ICMP down much more if you want to, to only allow, for example, echo reply to come in to your outbound interface.

SAbhi · 09-26-2013, 05:36 AM

Code:

iptables -A INPUT -p icmp --icmp-type 8 -s 0/0 -d [machine_IP] -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 0 -s [machine_IP] -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT

this could be a help, type 0 for echo-reply and type 8 for echo-request. the above will work even you don't use --icmp-type.

jaksis · 09-26-2013, 05:47 AM

Thanks you!

Looks like I somewhere failed with my script, because now it is working how I expected.