Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 1 down vote favorite

Currently, I have something like:

    iptables -A INPUT -p ICMP --icmp-type 8 -j DROP
    iptables -A INPUT -s x.x.x.x -p ICMP --icmp-type 8 -j ACCEPT

However, when I run the second command, it looks as if iptables just stops. I have to break out of it to get back to terminal. Perhaps I am doing it all wrong, but some insight would be helpful.

Thanks!

share|improve this question
You also need to flip it so that the the ACCEPT is first, or change -A to -I – Patrick Jun 14 '11 at 1:48
@Patrick when I do that, it seems as if it quits out at the start and doesn't write the rule. – Square Jun 14 '11 at 2:03
your first rule will have to come last if you look at iptables -L -nv and check out the counters when you're testing your rules you'll find out it's probably incrementing dropping the packets never reaching your other rule. – xenoterracide♦ Jun 14 '11 at 2:32

3 Answers

up vote 1 down vote accepted

You need to run your rules in the opposite order. Iptables is sensitive to the order that commands were run. If a rule matches, it doesn't go on to check more rules, it just obeys that one. If you set the drop first, the accept rule will never get tested. By setting the specific accept with the source IP, then setting the more general policy to drop you will affect the expected behavior.

iptables -A INPUT -s x.x.x.x -p ICMP --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP

As for the hang problem you seem to be having, are you sure you entered a valid IP address? Perhaps you can prefix that command with strace iptables … to see what it's doing while it appears to hang.

share|improve this answer
Thanks for the great explanation. Looks like this was happening with another ruleset also, causing it to hang! – Square Jun 14 '11 at 14:02
up vote 1 down vote

Do not drop ICMP willy-nilly! Sure, some of the ICMP requests are dangerous, but the rest is absolutely required for the network to work (think "destination unreachable" and that zoo).

share|improve this answer
up vote -1 down vote

YOu have to add a rule like

iptables -A INPUT -s x.x.x.x -p icmp --icmp-type echo-reply -j ACCEPT

share|improve this answer
I just tried that, and it did the same thing -- to no avail. – Square Jun 14 '11 at 1:48
you run those command in that order??? Rules in iptables , As far as i concern, are execute from botton to top – Luciano Facchinelli Jun 14 '11 at 2:15
This is just an alternate syntax for the rule the OP was already running. – Caleb Jun 14 '11 at 8:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.