To ping or not to ping...

jharris · 08-27-2002, 01:42 AM

In my case not a bl**dy chance of a ping!

Someone point out what obvious thing I'm missing here... I'm just setting up a router/firewall at work, and everything works lovely apart from I can't ping through the firewall. I'm using iptables, the forward policy is set to 'drop' and I've got an explicit rule to allocal ICMP through so I've got this:

Code:

$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -m icmp -p icmp -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m icmp -p icmp -j ACCEPT
<<lots more rules>>

But alas no ICMP echo requests or replys get forwarded.

Suggestions please?

cheers all

Jamie...

jharris · 08-27-2002, 01:52 AM

From iptables -L -n -v just incase its any use...

Code:

Chain FORWARD (policy DROP 2 packets, 168 bytes)
 pkts bytes target     prot opt in     out     source               destination
  199 14810 ACCEPT     all  --  eth0   eth1    0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED
  191 16730 ACCEPT     all  --  eth1   eth0    0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  eth1   eth0    0.0.0.0/0            0.0.0.0/0          icmp type 0
    0     0 ACCEPT     icmp --  eth0   eth1    0.0.0.0/0            0.0.0.0/0          icmp type 0

Jamie...

unSpawn · 08-27-2002, 03:32 AM

You could try deleting the "-m icmp" on the forward chain, filter outbound for "-m state --state new established related" and in for related. If you're filtering types, the type you want to allow out and back in is echo request, IIRC.

In general when TS'ing fw scripts I'd go for "catch all" logging rules, restart the script and see what's getting dropped off a chain.

HTH

jharris · 08-27-2002, 03:55 AM

Show off...

Yeah that works fine now but I don't get why as if you read the man page -m is implicitly called when you use -p. Nevermind all seems well

Cheers

Jamie...

peter_robb · 08-29-2002, 09:55 AM

The --state RELATED only matches icmp error responses related to existing connections. icmp doesn't have a 'state' inside conntrack.

Regards,
Peter