Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am using iptables to allow the icmp traffic in/out of my host. Please find below are the entries from my firewall (linux based):-

[root@localhost ~]# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh state NEW,RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request state NEW,ESTABLISHED

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply state ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:ssh state RELATED,ESTABLISHED

When I am trying to ping the host I am getting the following error:-

[root@localhost ~]# ping 192.168.1.3 ##192.168.1.3 is the IP of the firewall
PING 192.168.1.3 (192.168.1.3) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted

Which rule should I add to the OUTPUT CHAIN of filter table to get this done. I don't want all traffic to go out; so I have selected DROP as the default policy for the chain

share|improve this question
1  
One thing you want to watch with the firewall ruleset as described above is that it looks like you have the default input policy as accept, really for firewalls the default policy should be drop –  Rоry McCune Feb 27 '13 at 18:02
    
@Rory, yes I have made the changes to default input policy. –  Ankit Feb 28 '13 at 2:42
    
You shouldn't be blocking most ICMP packets at all. See serverfault.com/questions/84963/why-not-block-icmp –  mikebabcock Jun 3 '13 at 15:46

1 Answer 1

You have the rules backwards. In INPUT you must have icmp-reply and in OUTPUT icmp-request

share|improve this answer
    
thegeekstuff.com/scripts/iptables-rules read #12 is this correct yzT? –  Saladin Feb 28 '13 at 13:29
    
yep, #12 and #13 are ok. –  yzT Feb 28 '13 at 14:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.