[SOLVED] trying iptables ping rate limiting = ping timeouts, but tcpdump shows responses??

psycroptic · 10-29-2013, 11:24 PM

trying this at the top of my iptables INPUT chain to rate limit pings:

Code:

-A INPUT -p icmp --icmp-type echo-request -m limit --limit 3/s --limit-burst 1 -j ACCEPT
-A INPUT -p icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp -j DROP

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

disables pinging out from the current system (i.e. ping initiated from the local system shows no responses, and timeouts from each packet), even though tcpdump on the same system reports requests & responses normally:

Code:

23:18:03.703641 IP 172.16.16.1 > 172.16.16.254: ICMP echo request, id 418, seq 1, length 64
23:18:03.704189 IP 172.16.16.254 > 172.16.16.1: ICMP echo reply, id 418, seq 1, length 64
23:18:04.710797 IP 172.16.16.1 > 172.16.16.254: ICMP echo request, id 418, seq 2, length 64
23:18:04.711253 IP 172.16.16.254 > 172.16.16.1: ICMP echo reply, id 418, seq 2, length 64
23:18:05.710679 IP 172.16.16.1 > 172.16.16.254: ICMP echo request, id 418, seq 3, length 64
23:18:05.711205 IP 172.16.16.254 > 172.16.16.1: ICMP echo reply, id 418, seq 3, length 64
23:18:06.710719 IP 172.16.16.1 > 172.16.16.254: ICMP echo request, id 418, seq 4, length 64
23:18:06.711156 IP 172.16.16.254 > 172.16.16.1: ICMP echo reply, id 418, seq 4, length 64

any earthly idea why? doesn't make a lick of sense to me. external systems can ping in just fine.

Ygrex · 10-30-2013, 01:36 AM

these rules do not block pings originated locally, look at the iptables counters if in doubt

psycroptic · 10-30-2013, 09:19 PM

well, it seems like they were; changing to this:

Code:

-A INPUT -p icmp --icmp-type echo-request -m limit --limit 3/s --limit-burst 1 -j ACCEPT
-A INPUT -p icmp --icmp-type echo-request -j DROP
-A INPUT -p icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp --icmp-type 11 -j ACCEPT

works as expected.

a tutorial i found said to place a blanket ICMP -j DROP at the end of the icmp-related INPUT section. Apparently it was wrong.

Ygrex · 10-31-2013, 12:00 AM

you'd better move this rule in the correct place:

Code:

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

I guess it is stated clear in your tutorial

psycroptic · 10-31-2013, 12:12 AM

sorry that is above this

Ygrex · 10-31-2013, 12:25 AM

since your solution works as expected you can also remove accepting rules for ICMPs 3 and 11, they do nothing here

maybe you can share a link to the tutorial that advices accept related connections only after rejecting rules?