Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am creating a NAT with iptables:

Computer A: eth0 (dhcp) + eth1 (static ip 192.168.0.1 - gateway) Computer B: eth1 (static ip 192.168.0.2, using Computer A as gateway)

I know how to block ICMP outgoing requests (-A OUTPUT -p icmp --icmp-type echo-request -j DROP), but that would block ICMP requests from Computer A, but not from Computer B (in fact, only for Computer A - Computer B can keep doing those).

I tried with the same command, but adding -o eth1, but that does not block at all. Any idea?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

You need to add this to the FORWARD table. (-A FORWARD).

  • INPUT is for packets coming to the host (packets where the host is the destination, so in your case, packets destined for host A)
  • OUTPUT is for packets going out of the host (originating on host A, going somewhere else)
  • FORWARD is for packets forwarded for some other host (B in your case), to another host (whatever you are pinging, somewhere in the internet). Since those packets are just forwarded for someone else, FORWARD table is used here.
share|improve this answer
    
Yes, you are totally right, I was missing that. Thank you! Just in case, this is the final result for anyone who wants it: -A FORWARD -p icmp --icmp-type echo-request -j DROP –  Raj Oct 28 '12 at 22:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.