2

I've configured my linux router with the following iptables rules

iptables --list-rules
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A FORWARD -i vmbr0 -o eth2 -j ACCEPT 
-A FORWARD -i vmbr0 -o eth1 -j ACCEPT 
-A FORWARD -i eth1 -o vmbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -i eth2 -o vmbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT

eth1 and eth2 are wan interfaces. vmbr0 is my private network. Ping requests to eth2 ip address from a remote machine are being dropped and so are http requests.

How can I fix this?

Prashanth Ellina
  • 145
  • 1
  • 6

3 Answers3

1

If you want to allow ICMP ping request, try this:

iptables -A INPUT -p icmp --icmp-type 8 -s 0/0 -d <eth2_ip> -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 0 -s <eth2_ip> -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
  • 8 is code for echo-request
  • 0 is code for echo-reply
quanta
  • 51,413
  • 19
  • 159
  • 217
1

If the host firewall isn't blocking any ICMP packets, check the kernel parameter relating to ICMP.

$ sysctl net.ipv4.icmp_echo_ignore_all
net.ipv4.icmp_echo_ignore_all = 0

This is normally set in /etc/sysctl.conf; if this host is on the Internet, you generally don't want it to respond to pings (ICMP).

Note, too, that ICMP is neither TCP nor UDP - so you have to allow it with different rules than you would for TCP or UDP.

For debugging purposes, I'd use tcpdump to sniff network traffic on the host - to see what packets are being seen - as well as doing this command:

watch -d iptables -L -v -n

This command will probably show you which rule is being selected, as long as there isn't too much traffic hitting the firewall.

Mei
  • 4,590
  • 8
  • 45
  • 53
  • I checked the kernel parameter and it is set to 0. – Prashanth Ellina Aug 25 '11 at 09:28
  • What is the output from `iptables -L -v -n` telling you? If the `watch` command isn't on your router, try this: `while true; do sleep 2 ; iptables -L -v -n ; done` - use ^C to quit the display. – Mei Aug 25 '11 at 18:34
0

It appears that every rule you have listed is an ACCEPT rule, including the defaults. From that, your configuration should not drop or deny any packet. I think your issue is elsewhere.

Jeff Ferland
  • 20,547
  • 2
  • 62
  • 85