Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I am using iptables to allow the icmp traffic in/out of my host. Please find below are the entries from my firewall (linux based):- 

[root@localhost ~]# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh state NEW,RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request state NEW,ESTABLISHED

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply state ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:ssh state RELATED,ESTABLISHED

When I am trying to ping the host I am getting the following error:-

[root@localhost ~]# ping 192.168.1.3 ##192.168.1.3 is the IP of the firewall
PING 192.168.1.3 (192.168.1.3) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted

Which rule should I add to the OUTPUT CHAIN of filter table to get this done. I don't want all traffic to go out; so I have selected DROP as the default policy for the chain

share|improve this question
1  
One thing you want to watch with the firewall ruleset as described above is that it looks like you have the default input policy as accept, really for firewalls the default policy should be drop – Rory McCune Feb 27 at 18:02
@Rory, yes I have made the changes to default input policy. – Ankit Feb 28 at 2:42

1 Answer

up vote 1 down vote

You have the rules backwards. In INPUT you must have icmp-reply and in OUTPUT icmp-request

share|improve this answer
thegeekstuff.com/scripts/iptables-rules read #12 is this correct yzT? – Saladin Feb 28 at 13:29
yep, #12 and #13 are ok. – yzT Feb 28 at 14:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.