fake icmp response

c0lin · 01-21-2005, 12:24 PM

Can somebody help me with this:
usually when i ping my firewall from outside (Internet) i get a "Request timed out" because of the

Quote:

iptables -P DROP

Instead of this message id like that the firewall to respond with a

Quote:

Destination host unreachable

This issue appeared when somebody noticed that if he pings the firewall when is powered off it responds with a

Quote:

Destination host unreachable

and
if he pings the firewall when is powered on it responds with a

Quote:

Request timed out

c0lin · 01-21-2005, 02:02 PM

I should googled a little bit more...

Quote:

iptables -A -p icmp -j REJECT --reject-with icmp-host-unreachable

SciYro · 01-21-2005, 09:42 PM

careful, that will reject all icmp requests, so add some lines before that to except some icmp types, personally tho, i also block types (i think it was) 15-18 (they are requests for info) , and only allow "related" icmp traffic thru after that

Capt_Caveman · 01-22-2005, 12:06 AM

Agreed. Blocking all ICMP traffic is going to make your system hang when a webpage/site is unavailable, rather then immediately generating an error. Allow ESTABLISHED and RELATED and you should receive all important ICMP types. Also note that the rules you posted doesn't have a chain associated with it (INPUT, OUTPUT, FORWARD, etc) and will fail.