LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   Iptables (https://www.linuxquestions.org/questions/linux-newbie-8/iptables-4175510662/)

thirstonlinux 07-10-2014 02:37 AM

Iptables
 
Is there a difference between the following firewall rules. If so please explain me, I could not make out the difference.

iptables -t filter -A INPUT -s <IP> --icmp-type echo-request -j DROP

iptables -t filter -A INPUT -s <IP> -icmp-type echo-request -j DROP

iptables -t filter -A INPUT -s <IP> -p tcp -icmp-type echo-request -j DROP

iptables -t filter -A INPUT -s <IP> -p icmp -icmp-type echo-request -j DROP

iptables -t filter -A INPUT -s <IP> -p icmp --icmp-type echo-request -j DROP

Ser Olmy 07-10-2014 07:48 PM

Quote:

Originally Posted by thirstonlinux (Post 5201564)
Is there a difference between the following firewall rules. If so please explain me, I could not make out the difference.

iptables -t filter -A INPUT -s <IP> --icmp-type echo-request -j DROP

The syntax of this rule is invalid, as the --icmp-type subparameter can only be used when the ICMP protocol is explicitly specified.
Quote:

Originally Posted by thirstonlinux (Post 5201564)
iptables -t filter -A INPUT -s <IP> -icmp-type echo-request -j DROP

The syntax of this rule is also invalid, as there's no such thing as an "-icmp-type" parameter.
Quote:

Originally Posted by thirstonlinux (Post 5201564)
iptables -t filter -A INPUT -s <IP> -p tcp -icmp-type echo-request -j DROP

Same as above. Also, the TCP protocol (-p tcp) does not carry ICMP packets, so the --icmp-type subparameter wouldn't be valid either.
Quote:

Originally Posted by thirstonlinux (Post 5201564)
iptables -t filter -A INPUT -s <IP> -p icmp -icmp-type echo-request -j DROP

Here you have specified the ICMP protocol, but the syntax of the subparameter is still wrong.
Quote:

Originally Posted by thirstonlinux (Post 5201564)
iptables -t filter -A INPUT -s <IP> -p icmp --icmp-type echo-request -j DROP

This is the only rule with a valid syntax. It will drop ICMP Echo Request packets ("pings") from the host <IP> to any IP address assigned to the local host.


All times are GMT -5. The time now is 05:04 PM.