-1

these are my current iptables settings:

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
DROP       tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE 
DROP       tcp  --  anywhere             anywhere            tcp flags:!FIN,SYN,RST,ACK/SYN state NEW 
DROP       tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

The problem is, that when I ping the server, I get this result:

PING XX.XX.XX.XX (XX.XX.XX.XX): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
Request timeout for icmp_seq 5

etc...

So I guess it has something to do with the iptables. As you can see, the sites inside the server are running just fine:

nmap -p 80 XX.XX.XX.XX

Starting Nmap 6.47 ( http://nmap.org ) at 2015-03-27 09:44 CDT
Nmap scan report for XX.XX.XX.XX
Host is up (0.0019s latency).
PORT STATE SERVICE
80/tcp open http

So, the question is: what can I do to avoid the ping timeout? (and what are the disadvantages of returning a ping timeout?)

6
  • 1
    Ping doesn't work but the web server works. I see no problem here. Why are you hung up on whether or not ping works?
    – joeqwerty
    Mar 27, 2015 at 14:56
  • @joeqwerty forgot to mention that I use a monitoring service that checks the ping latency every 5 minutes (among other metrics). That way, I can measure the ping timing. If it's too slow (or timeout) I receive an email. Mar 27, 2015 at 14:59
  • 2
    You provided your iptables rules. Look at them: what do you see missing from the ruleset?
    – EEAA
    Mar 27, 2015 at 15:01
  • 4
    Why don't you monitor the response time of something like a web page loading? Wouldn't that be more relevant? It's a web server, why do you care what the ping response time is? Shouldn't you care more about the response time of the website? My point being, too many people rely on or use ping for the wrong reasons. What if the ping response time is 1ms but a page load is 200ms? What if ping response time is 200ms but a page load is 1ms?
    – joeqwerty
    Mar 27, 2015 at 15:02
  • I agree with @joeqwerty, switch the method of testing to something other than ping, it's a poor test and will bring you much headache in future. Perhaps test for a 200OK response?
    – MDMoore313
    Mar 27, 2015 at 15:15

3 Answers 3

3

You need to allow ICMP requests inbound, something like this should do it:

iptables -A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
1
  • I would recommend using the macros echo-request/echo-reply instead of icmp--type 8. Makes it a little more expressive for people like OP. Mar 27, 2015 at 15:04
3

You don't have ICMP allowed in your iptables rules.

iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
0

Allow ICMP and your ICMP Echo Request will reach the server, allowing it to reply back.

Not the answer you're looking for? Browse other questions tagged .