i have a linux server running RedHat and i want to make it pingable but invisible to traceroute/tracert.
i set some iptables rules but whatever i try is either block or allow both ping and traceroute.
i could make it work on another machine running FreeBSD using ipfw with the following rule ipfw add deny icmp from me to any icmptypes 11 out
this rule allow me to ping my machine and when the trace reach the machine it skip it and shows *****.
how can i acheave this in redhat using iptables or any other possible way?
thank you!!
-
1traceroute (and tracepath) use a variety packet of types and methods depending on arguments, operating system, etc. If FreeBSD worked for you, it was just a lucky test combination.– h0tw1r3Dec 10, 2015 at 15:14
Add a comment
|
1 Answer
The Internet Control Message Protocol (ICMP) has many messages that are identified by a "type" field. You need to use 0 and 8 ICMP code types.
(0) is for echo-reply
(8) is for echo-request
For iptables first set your IP:
SERVER_IP="<put_your_ip_here>"
Second, allow pings
iptables -A INPUT -p icmp --icmp-type 8 -s 0/0 -d $SERVER_IP -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 0 -s $SERVER_IP -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT
An next rule is disable ICMP at all
iptables -A INPUT -p icmp -s 0/0 -d $SERVER_IP -j DROP