Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've configured my linux router with the following iptables rules

iptables --list-rules
-A FORWARD -i vmbr0 -o eth2 -j ACCEPT 
-A FORWARD -i vmbr0 -o eth1 -j ACCEPT 
-A FORWARD -i eth1 -o vmbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -i eth2 -o vmbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT 

eth1 and eth2 are wan interfaces. vmbr0 is my private network. Ping requests to eth2 ip address from a remote machine are being dropped and so are http requests.

How can I fix this?

share|improve this question
up vote 0 down vote accepted

It appears that every rule you have listed is an ACCEPT rule, including the defaults. From that, your configuration should not drop or deny any packet. I think your issue is elsewhere.

share|improve this answer
Thanks. I think the issue is in my routing table and not here. – Prashanth Ellina Aug 25 '11 at 9:28

If you want to allow ICMP ping request, try this:

iptables -A INPUT -p icmp --icmp-type 8 -s 0/0 -d <eth2_ip> -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 0 -s <eth2_ip> -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
  • 8 is code for echo-request
  • 0 is code for echo-reply
share|improve this answer

If the host firewall isn't blocking any ICMP packets, check the kernel parameter relating to ICMP.

$ sysctl net.ipv4.icmp_echo_ignore_all
net.ipv4.icmp_echo_ignore_all = 0

This is normally set in /etc/sysctl.conf; if this host is on the Internet, you generally don't want it to respond to pings (ICMP).

Note, too, that ICMP is neither TCP nor UDP - so you have to allow it with different rules than you would for TCP or UDP.

For debugging purposes, I'd use tcpdump to sniff network traffic on the host - to see what packets are being seen - as well as doing this command:

watch -d iptables -L -v -n

This command will probably show you which rule is being selected, as long as there isn't too much traffic hitting the firewall.

share|improve this answer
I checked the kernel parameter and it is set to 0. – Prashanth Ellina Aug 25 '11 at 9:28
What is the output from iptables -L -v -n telling you? If the watch command isn't on your router, try this: while true; do sleep 2 ; iptables -L -v -n ; done - use ^C to quit the display. – Mei Aug 25 '11 at 18:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.