IP Tables list (Why can't I ping out?)

m15a4 · 02-13-2004, 02:17 AM

What rule is preventing me from pinging other sites from behind this IP Tables rule?

# /sbin/iptables --version
iptables v1.2.7a
# /sbin/iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp -- anywhere anywhere tcp dpt:www reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:telnet reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

killer_bunny · 02-13-2004, 03:39 AM

Well, by the looks of it none...

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DROP icmp -- anywhere anywhere icmp echo-request

This blocks outgoing pings.
As you don't have this rule anywhere i dont see why u couldn't ping anyone...

moonloader · 02-13-2004, 07:39 AM

try to ping as root!

m15a4 · 02-13-2004, 11:05 AM

Thanks for the replys but honestly, I can't

I've tried as root and user no difference.

I can see / run the ping command, I can ping my LAN all day no problem. Heck I can even ping the WAN side of my router, but Can't ping anything further out. I have also tried pinging from boxes running Win 98 / Win XP / SuSE PRO / SuSE (standard). So it's not the O.S. doing it.

jazernorth · 02-13-2004, 11:12 AM

Your router is not allowing pings to leave your network. Contact the Router vendor on how to enable the ping port.

m15a4 · 02-13-2004, 04:31 PM

Quote:

Originally posted by jazernorth
Your router is not allowing pings to leave your network. Contact the Router vendor on how to enable the ping port.

Ping isn't on a 'port'.

What would be blocking pings if not the IP tables.

killer_bunny · 02-13-2004, 06:13 PM

Quote:

Originally posted by m15a4
Ping isn't on a 'port'.

What would be blocking pings if not the IP tables.

ISP

Try shutting down IPTABLES with

# /sbin/services iptables stop

and then try pinging.

If it doesen't work then it isn't cause of iptables

jazernorth · 02-16-2004, 09:20 AM

Yeah, Pings is not a PORT, but you need to have ICMP activated with IPTABLES. So I call it a port.

Code:

EXTIP = 'xxx.xxx.xxx.xxx' # External IP Address
EXTIF = 'eth0' # External Interface
IPTABLES = 'iptables' #iptables bin name
UNIVERSE = '0.0.0.0' #all IP's

# To open the server to accept and send ICMP requests.
$IPTABLES -A INPUT -i $EXTIF -p ICMP -s $UNIVERSE -d $EXTIP -j ACCEPT

chrisfirestar · 02-20-2004, 04:33 AM

try typing

echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all

not sure if that effects outgoing pings or not.. i dont think it does...
are you trying to ping from the gateway or behind the gateway

peter_robb · 02-20-2004, 09:42 AM

Quote:

try typing
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
not sure if that effects outgoing pings or not.. i dont think it does...

This stops the box itself from replying to pings...
Wouldn't have any effect on forwarded pings..

Quote:

Yeah, Pings is not a PORT, but you need to have ICMP activated with IPTABLES. So I call it a port.

Ping and other protocols are always activated in the kernel, (unless you remove them)..
iptables merely gives you some control over them.. eg writing a rule to block, redirect etc
You would only need to allow them if you had a DROP policy to catch unspecified connections.

The 2 rules m15a4 mentioned have no effect on outgoing pings...
So I would suggest as killer_bunny did, isolate the problem.
Clear the rules and eliminate them as a possible cause...
Also add some -j LOG entries via the command line to watch what is happening...
eg iptables -t nat -I POSTROUTING -j LOG

When listing rules, please use iptables-save to print them on the screen.
iptables -nL only shows 1 table and interpretes the rules quite inaccurately..