I'm trying to configure iptables rules on a router that allows ICMP (PMTU-D, ping, traceroute, etc.) to function.


1) Allow all ICMP outbound traffic initiated from the router and internal clients.

2) Allow ICMP inbound traffic only for replies to router and client initiated connections.

3) Drop all other ICMP inbound traffic from the WAN.


1) Are the icmp-types below reply messages to client and router initiated requests ?




2) Are icmp-types 5 and 9-12 reply messages ?

  • Note that dropping ICMP packets without exactly knowing what you are doing will mess with other applications that legitimately communicate with your devices, and possibly break them, and later you'll have fun debugging it. Unless you are suffering a DoS attack with ICMP packets, there's no need to block them.
    – dirkt
    Commented May 31, 2017 at 6:55

1 Answer 1


NOTE: It sounds like this is more of a firewall question than a router question.

Don't even try to worry about various ICMP types and which ones you have to match against which packets to permit in which directions. Just rely on the kernel's connection tracking feature and permit

  • all ICMP (or all packets) outbound, and
  • inbound packets belonging to existing tracked sessions:

    iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
  • Are there any WAN side initiated, inbound messages that wouldn't be caught with connection tracking ?
    – uihdff
    Commented May 30, 2017 at 20:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .