1

My server is Ubuntu 12.04:-> IP 192.168.56.100 I have a client Ubuntu 13.04:-> IP 192.168.56.101

I have to block the ping from client to server So I wrote the IPTABLE rule.

iptables -A INPUT -i eth0 -p ICMP -s 192.168.56.101 -j DROP

Now client can't ping to the Server that part is fine, but server can't ping to client which should not be happening. Before adding this rule both the server and client could ping each other.

Please tell me what am I missing here...

Answers given are correct but how does it works....??? Adding --icmp-type echo-request does resolve the issue but this rule is being added to the INPUT chain rules, so how can this rule anyway mess with the OUTPUT chain, as it's blocking the ping to client.

2 Answers 2

1

As I understand ping command sends ICMP echo request to the host, then host reply ICMP echo reply. So if you block all ICMP, ping doesn't work at all.

You should add this:

iptables -A INPUT -i eth0 -p icmp --icmp-type echo-request -s 192.168.56.101 -j DROP

This will block only request, but not reply

Answering you question in comments

It does not blocking outgoing ping request. It is blocking all incoming ICMP packets.

When you execute ping:

  1. ping send ICMP request packet to 192.168.56.101 (It is outcoming ICMP)

  2. 192.168.56.101 receive this packet and send reply ICMP packet back to your server

  3. Now your server iptables block this incoming reply packet. That's what is happening.

You can check it using this command sudo tcpdump ip proto \\icmp on 192.168.56.101. It will show you all ICMP requests/replies online.

Do this:

  1. Remove this rule from server:

    iptables -A INPUT -i eth0 -p icmp --icmp-type echo-request -s 192.168.56.101 -j DROP

  2. Add this rule to your server:

    iptables -A INPUT -i eth0 -p ICMP -s 192.168.56.101 -j DROP

  3. Now execute this command on 192.168.56.101:

    sudo tcpdump ip proto \\icmp

  4. Execute ping 192.168.56.101 on server.

Now you should see on 192.168.56.101 that it receive ping request, and send reply. But iptables on server block this reply.

3
  • Hey C0rp one more doubt, here i'm adding the rule to the INPUT chain that means it will only affect the packets that comes into server, so why should my initial rule block the outgoing ping request ..?
    – nkg
    Feb 9, 2014 at 9:58
  • I update answer
    – c0rp
    Feb 9, 2014 at 10:53
  • Thanks for the details answer C0rp..I was nvr thought of the echo reply packets...thank you for your time..Now I got it..
    – nkg
    Feb 9, 2014 at 18:02
0

Obviously you are not going to get any reply back. A ping request has two parts:

  • Client -> Server: ICMP echo-request (a.k.a. "ping")
  • Server -> Client: ICMP echo-reply (a.k.a. "pong")

Blocking all types of ICMP will bring trouble. If you would like to prevent the client from "pinging" (sending a PING request), then use the following rule on the server:

-A INPUT -i eth0 -s 192.168.56.101/32 -p ICMP --icmp-type echo-request -j DROP

To prevent the client from sending a ICMP ping request in the first place, you could apply this rule on the client:

-A OUTPUT -o eth0 -d 192.168.56.100/32 -p ICMP --icmp-type echo-request -j DROP

It is highly unusual to avoid block a client from pinging a single IP address, from the client side though. The only reason you would do this is because your assignment requires that no ICMP ping packet flows through the network from the client, directed to the server.

I wonder why you want to block ping requests on a LAN though. With ARP, the client can still know that this server is connected to the network.

4
  • It's part of my academic assignment...Thanks for the reply Lenkensteyn..it worked !!
    – nkg
    Feb 9, 2014 at 9:46
  • Hey Lekensteyn one more doubt, here i'm adding the rule to the INPUT chain that means it will only affect the packets that comes into server, so why should my initial rule block the outgoing ping request ..?
    – nkg
    Feb 9, 2014 at 9:58
  • @Nikhil See update, the OUTPUT chain is used on the client to prevent echo-request from leaving the client. The INPUT chain on the server prevents the echo-reply from being accepted. I suggest to have a look at this packet flow picture from Wikipedia, it is very helpful if you are new to iptables (netfilter is the previous name).
    – Lekensteyn
    Feb 9, 2014 at 14:29
  • Thank you for your time Lekensteyn..I got it clear now..
    – nkg
    Feb 9, 2014 at 17:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .