Reject icmp packet thru iptables

From: Shiraz Baig (shiraz_baig_at_yahoo.com)
Date: 02/21/05

  • Next message: Mike Burger: "Re: Procmail permission problem." 
    Date: Sun, 20 Feb 2005 20:35:59 -0800 (PST)
To: redhat <redhat-list@redhat.com>

    Sir,
    I am trying to see the working of iptables. I read the
    relevantHOWTOs and tried an experiment to get an icmp
    packet rejected. This experiment is from one of the
    HOWTOs. But my experiment has not succeeded.

    Could someone tell me why my ICMP packet was not
    rejected in spite of the fact that rules show that it
    should be rejected.

    Here is what I did.

    Step 1:
    I did the following to test that icmp protocol packets
    are allowed:
            #ping -c 1 127.0.0.1

    I got the response:

    --- 127.0.0.1 ping statistics ---
    1 packets transmitted, 1 received, 0% packet loss,
    time 0ms
    It showed icmp packets can go thru.

    Step 2:
    I checked the rules to make sure the above fact.
            #iptables -L
    I got the response:
    --------- response ----------
    Chain INPUT (policy ACCEPT)
    target prot opt source destination
          
    RH-Lokkit-0-50-INPUT all -- anywhere
    anywhere
    ................ remaining skipped ............

    Step 3:
    Now I gave a command to deny the icmp proto packets.
      # iptables -A INPUT -s 127.0.0.1 -p icmp -j REJECT

    Step 4:
    Now I wanted to check that the icmp proto packets are
    not allowed.
    First I checked the rules.
         #iptables -L
    I got the response:
    --------- response ---------------------
    Chain INPUT (policy ACCEPT)
    target prot opt source destination
          
    RH-Lokkit-0-50-INPUT all -- anywhere
    anywhere
    REJECT icmp -- localhost.localdomain anywhere
           reject-with icmp-port-unreachable

    .................. remaining clipped .............

    Step 5:
    Now I gave the command ping to see that icmp packets
    are rejected.
       # ping -c 1 127.0.0.1

    I got the response:
    --- 127.0.0.1 ping statistics ---
    1 packets transmitted, 1 received, 0% packet loss,
    time 0ms

    It showed that the packet was not rejected. It is
    stilll allowed to pass thru.

    Question
    My question is why this packet was not rejected. The
    ruleset shows that this packet should be rejected. But
    it has been accepted. Why?
    bye
    shiraz

                    
    __________________________________
    Do you Yahoo!?
    The all-new My Yahoo! - What will yours do?
    http://my.yahoo.com 

    -- 
redhat-list mailing list
unsubscribe mailto:redhat-list-request@redhat.com?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
  • Next message: Mike Burger: "Re: Procmail permission problem."

    Relevant Pages

    • Re: unexpected ICMP host unreachable - no worries?
      ... an attack?". ... You observed ICMP backscatter traffic. ... I'm guessing this packet is remote controlling command to distributed ... easily relate that outgoing scan or outbound flood packets after detect ...
      (comp.os.linux.security)
    • Re: Why some hosts in Internet not prefer to be traceroute-d ?
      ... i.e. not to send a TTL exceeded ICMP packet back to the host. ... This block may be not generating ICMP type 11 (most ... exceeded" reply associated with a UDP packet, ...
      (comp.os.linux.networking)
    • Re: Interesting fw log: "ICMP type 3 not embeddable"
      ... I've seen ICMP type 3 embedded TCP or UDP datagram but never seen ICMP ... REJECT incoming ICMP 3 packet) or is using ICMP mis-implementation OS ... is running BSD code based some router. ...
      (comp.os.linux.security)
    • Re: Interesting fw log: "ICMP type 3 not embeddable"
      ... I've seen ICMP type 3 embedded TCP or UDP datagram but never seen ICMP ... REJECT incoming ICMP 3 packet) or is using ICMP mis-implementation OS ... is running BSD code based some router. ...
      (comp.os.linux.security)
    • FW: ICMP fragmentation required but DF set problems.
      ... ICMP fragmentation required but DF set problems. ... against some TCP/IP stack. ... Anyway the stack takes an hash table with the MTU of other ends. ... size of the quoted packet in the ICMP packet, ...
      (FreeBSD-Security)