I'm trying to configure iptables rules on a router that allows ICMP (PMTU-D, ping, traceroute, etc.) to function.


1) Allow all ICMP outbound traffic initiated from the router and internal clients.

2) Allow ICMP inbound traffic only for replies to router and client initiated connections.

3) Drop all other ICMP inbound traffic from the WAN.


1) Are the icmp-types below reply messages to client and router initiated requests ?




2) Are icmp-types 5 and 9-12 reply messages ?

  • Note that dropping ICMP packets without exactly knowing what you are doing will mess with other applications that legitimately communicate with your devices, and possibly break them, and later you'll have fun debugging it. Unless you are suffering a DoS attack with ICMP packets, there's no need to block them. – dirkt May 31 '17 at 6:55

NOTE: It sounds like this is more of a firewall question than a router question.

Don't even try to worry about various ICMP types and which ones you have to match against which packets to permit in which directions. Just rely on the kernel's connection tracking feature and permit

  • all ICMP (or all packets) outbound, and
  • inbound packets belonging to existing tracked sessions:

    iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
  • Are there any WAN side initiated, inbound messages that wouldn't be caught with connection tracking ? – uihdff May 30 '17 at 20:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.