[SOLVED] can't save iptables rule

cbider · 08-15-2013, 11:01 PM

Attempted to drop incoming pings using "/sbin/iptables -A INPUT -p icmp --icmp-type echo-request -j DROP" as root and then saved rule with "/sbin/service iptables save" I then pinged the host using "ping 192.168.1.8 and got the folloing result."---192.168.1.8 ping statistics--- 15 packets transmitted, 15 received, 0% packet loss, time 14221ms, rtt mim/avg/max/mdev = 0.385/0.550/0.734/0.105 ms" The rule shows as being saved in /etc/sysconfig/iptables. Why then is the host returning pings instead of dropping them. I'm using the bash shell on SL 6.4. I got the rule from an O'reilly book entitled Linux Security Cookbook. Is there another way to make this happen. Thanks in advance!

SAbhi · 08-16-2013, 12:44 AM

Please consider putting the commands and codes under [ code ] [ /code ] so it would be easy to read.

well the rule you had should have worked, cant say why it wouldnt:

TRY putting this rule:

Code:

iptables -A OUTPUT -p icmp --icmp-type 8 -j DROP

if still not working try below, i found it on some random website:

Code:

iptables -A OUTPUT -p icmp -o eth0 -j ACCEPT          
iptables -A INPUT -p icmp --icmp-type echo-reply -s 0/0 -i eth0 -j ACCEPT     
iptables -A INPUT -p icmp --icmp-type destination-unreachable -s 0/0 -i eth0 -j ACCEPT  
iptables -A INPUT -p icmp --icmp-type time-exceeded -s 0/0 -i eth0 -j ACCEPT       
iptables -A INPUT -p icmp -i eth0 -j DROP

unSpawn · 08-16-2013, 02:32 AM

Quote:

Originally Posted by cbider

The rule shows as being saved in /etc/sysconfig/iptables. Why then is the host returning pings instead of dropping them.

You checked your rule was saved, that's good, but have you checked rule order? Might be you have preceding rules that already allow ICMP out?

SAbhi · 08-16-2013, 04:14 AM

Quote:

Originally Posted by unSpawn

You checked your rule was saved, that's good, but have you checked rule order? Might be you have preceding rules that already allow ICMP out?

Correct

@cbider: can you share output from:

Code:

/sbin/iptables -L -v -n | more

OR 

/sbin/iptables -t nat -L -v -n | more

cbider · 08-16-2013, 11:46 PM

Solved problem by using /etc/init.d/iptables restart, THEN pinged target from vm residing on it and also remote host and got nothing. After hitting ctrl-alt-c I got ping stats "57 packets transmitted, 0 received, 100% packet loss, time 56567ms". BINGO!!! Thanks to all who responded.