Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I want to "theoretically" disable that the clients can "ping" each other.

Can i use an iptables rule for it? e.g.:

iptables -A FORWARD -m iprange --src-range --dst-range -j DROP

Is it true that i cannot filter traffic between the clients?? [or at least redirect these packets to e.g.: the router?]

If i run tcpdump on the router ["server"] i can see that a client [] is pinging another []

# tcpdump
tcpdump: WARNING: eth0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
12:22:26.931343 IP > ICMP echo request, id 12547, seq 141, length 64
12:22:27.819373 IP > ICMP echo request, id 12547, seq 142, length 64
12:22:28.819640 IP > ICMP echo request, id 12547, seq 143, length 64
share|improve this question
I don't understand your question: it seems to me that the iptables rule you give does what you want. Your tcpdump shows that a client is pinging another client, and that's obviously not something you can prevent on the router; but you seem to have successfully prevented the other client from seeing this ping, what else did you expect? It's also confusing that you sometimes distinguish between “server” and “router”, yet they seem to be the same machine and it's only acting as a router. – Gilles Mar 5 '11 at 12:27

Where do you want to disable it? If all traffic runs through a router or switch that can run iptables then yes, it is simple.

If you want to block it on each machine, and they all run iptables, then yes, again - simple.

On most TCP/IP implementations you can disallow ICMP at the client end.

Almost all routers that allow access controls will let you block ICMP.

BUT...are you 100% certain you want to? A lot of apps really like a wee bit of ping to keep em happy :-)

share|improve this answer

What you have in mind is by all means feasible. Whether it is good design I can't tell.

Dropping any ICMP echo requests destined for the router:

iptables -t filter -I INPUT -p icmp --icmp-type 8 -j DROP

Dropping any forwarded ICMP echo requests

iptables -t filter -I FORWARD -p icmp --icmp-type 8 -j DROP

The reason you see each hosts packets is they are probably connected through a hub, which simply replicates traffic at a lower level. Dropping those packets on the server will not hinder them from arriving at the clients.

So, in order for the latter rule to work, you'll have to force the hosts forward their entire traffic to the router. That is done by limiting each host's subnet to its own address (using a subnet mask of for the hosts while sticking to on the router). Finally, you have to add a static route to each hosts routing table, so he can forward its packets to the server:

ip r a dev eth0

In this setup, the router can still ping all hosts.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.