-2

i have a linux server running RedHat and i want to make it pingable but invisible to traceroute/tracert. i set some iptables rules but whatever i try is either block or allow both ping and traceroute. i could make it work on another machine running FreeBSD using ipfw with the following rule ipfw add deny icmp from me to any icmptypes 11 out this rule allow me to ping my machine and when the trace reach the machine it skip it and shows *****. how can i acheave this in redhat using iptables or any other possible way? thank you!!

1
  • 1
    traceroute (and tracepath) use a variety packet of types and methods depending on arguments, operating system, etc. If FreeBSD worked for you, it was just a lucky test combination.
    – h0tw1r3
    Dec 10, 2015 at 15:14

1 Answer 1

1

The Internet Control Message Protocol (ICMP) has many messages that are identified by a "type" field. You need to use 0 and 8 ICMP code types.

(0) is for echo-reply
(8) is for echo-request

For iptables first set your IP:

SERVER_IP="<put_your_ip_here>"

Second, allow pings

iptables -A INPUT -p icmp --icmp-type 8 -s 0/0 -d $SERVER_IP -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 0 -s $SERVER_IP -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT

An next rule is disable ICMP at all

iptables -A INPUT -p icmp -s 0/0 -d $SERVER_IP -j DROP
1
  • Blocks a standard ping.
    – h0tw1r3
    Dec 10, 2015 at 15:56

Not the answer you're looking for? Browse other questions tagged .