2

On my linux box I've 2 NICS:

br0 192.168.1.0/24 (192.168.1.1 server)
eth1 192.168.2.0/24 lan1
eth2 192.168.3.0/24 lan2
[...]

there's a routing from eth1 to br0 and also from eth2 to br0

I droppped icmp echo requests on eth1 from same subnet:

iptables -A INPUT -i eth1 -p  icmp --icmp-type echo-request -j DROP

but I also want blocks icmp echo requests ONLY from 192.168.2.0/24 network on 192.168.1.1.

So I don't want that clients on 192.168.2.0/24 can ping 192.168.1.1

1

2 Answers 2

0

You need to specify the source IP or subnet with "-s" and the destination IP or subnet with "-d" Below a sample rule

iptables -A INPUT -s 192.168.2.0/24 -d 192.168.1.1/32 -p icmp -m hashlimit --hashlimit-upto 3/sec --hashlimit-burst 5 --hashlimit-mode srcip,dstip --hashlimit-name xticmp -m icmp --icmp-type 8 -j DROP

iptables -A INPUT -s 192.168.2.0/24 -d 192.168.1.1/32 -p icmp -m hashlimit --hashlimit-upto 3/sec --hashlimit-burst 5 --hashlimit-mode srcip,dstip --hashlimit-name xticmp -m icmp --icmp-type 30 -j DROP
0

check man iptables:

[!] -s, --source address[/mask][,...]

-s 192.168.2.0/24 affect the whole subnet.

2
  • doesn't run. I just tried
    – Pol Hallen
    Jul 18, 2016 at 18:19
  • @Pol --icmp-type is part of iptables-extensions. You may need to add -m option to use extension.
    – JohnKoch
    Jul 18, 2016 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.