Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am creating a NAT with iptables:

Computer A: eth0 (dhcp) + eth1 (static ip - gateway) Computer B: eth1 (static ip, using Computer A as gateway)

I know how to block ICMP outgoing requests (-A OUTPUT -p icmp --icmp-type echo-request -j DROP), but that would block ICMP requests from Computer A, but not from Computer B (in fact, only for Computer A - Computer B can keep doing those).

I tried with the same command, but adding -o eth1, but that does not block at all. Any idea?

share|improve this question
up vote 2 down vote accepted

You need to add this to the FORWARD table. (-A FORWARD).

  • INPUT is for packets coming to the host (packets where the host is the destination, so in your case, packets destined for host A)
  • OUTPUT is for packets going out of the host (originating on host A, going somewhere else)
  • FORWARD is for packets forwarded for some other host (B in your case), to another host (whatever you are pinging, somewhere in the internet). Since those packets are just forwarded for someone else, FORWARD table is used here.
share|improve this answer
Yes, you are totally right, I was missing that. Thank you! Just in case, this is the final result for anyone who wants it: -A FORWARD -p icmp --icmp-type echo-request -j DROP – Raj Oct 28 '12 at 22:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.