Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I wanna block ping from outside the company to my server, so I have the following iptables rules:

-A INPUT -p icmp --icmp-type 8 -s ! 192.168.0.0/16 -j DROP
-A OUTPUT -p icmp --icmp-type 0 -d ! 192.168.0.0/16 -j DROP

However, the above rules aren't working as expected, I can still ping the server from both inside and outside the company. What's wrong with that?!

share|improve this question

closed as not a real question by Michael Hampton, Ward, Tom O'Connor, mdpc, MadHatter Feb 13 '13 at 7:20

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
The rules you posted don't give us any useful information. You need to post your complete ruleset including the default policy of each chain. –  Khaled Feb 12 '13 at 9:29
    
default policy for each chain is ACCEPT, and I haven't addded any other rules. –  user538565 Feb 12 '13 at 9:33
    
Perhaps some kind of source NAT is in use. Use something like tcpdump or wireshark to look at the ICMP packets the server is receiving when you ping it. –  David Schwartz Feb 12 '13 at 9:43
    
Please note that dropping all ICMP packets is not a good idea. (The content of you post says ping, the title is generic/all ICMP). –  Hennes Feb 12 '13 at 12:01
    
I also tried to remove " ! ", and then ping from inside failed, while from outside succeeded. –  user538565 Feb 12 '13 at 13:50

3 Answers 3

I suppose that you have 2 network interfaces, one to Internet and one for your local network.

Try something like this:

IPTABLES -I INPUT -p icmp --icmp-type 8 -i INTERNET_ETH -j DROP 

The above will drop the Echo Request from the outside and I believe it is enough. After you see that the rule is working you play with source IP address. Also note the on the INTERNET_ETH interface ICMP requests with source address of 192.168.0.0/16 will not be received.

Good-Luck

share|improve this answer
    
my server has a customized OS, not a typical Linux/Unix machine. I can only find ifcfg-eth0, which maps to the mamagement port. therefore, your method doesn't work –  user538565 Feb 12 '13 at 12:06

Is there a device in front of the server? Like a router or something else that might be responding to the ping?

iptables –A INPUT –p icmp –icmp-type echo-request -s ! 192.168.0.0/16 –j DROP

Should do it though.

share|improve this answer
    
-A is probably falling foul of an earlier accept rule –  Iain Feb 12 '13 at 10:14

try

-A INPUT -p icmp --icmp-type 8 ! -s 192.168.0.0/16 -j DROP
-A OUTPUT -p icmp --icmp-type 0 ! -d 192.168.0.0/16 -j DROP
share|improve this answer
    
-A is probably falling foul of an earlier accept rule –  Iain Feb 12 '13 at 10:15
    
He said that no other rules were added. –  Laurentiu Roescu Feb 12 '13 at 10:17
    
not working at all... no difference to my rules, besides the position of the " ! " –  user538565 Feb 12 '13 at 13:57
1  
Position of "!" is important. –  Laurentiu Roescu Feb 12 '13 at 14:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.