0

I have a server with 4 KVM VMs running on it. These VMs have only one interface and all the interfaces are connected to the same OVS bridge.

I was trying to block the ping on those VMs using the following iptables command

iptables -A OUTPUT -o ${tap_interface} -p icmp -m icmp --icmp-type 8 -j DROP

However, it was not working. Then I said, let's go to the basics and block all the ping messages, even the ones from the server. So I executed:

iptables -A OUTPUT -p icmp -m icmp --icmp-type 8 -j DROP

The situation now is that my server cannot ping (and I see packets hitting the previous rule) but my VMs are still able to ping. I don't understand why the traffic from the VMs is bypassing the rule.

Improve this question
  • you need to add the same for input too. iptables -A INPUT -p icmp --icmp-type echo-request -j REJECT – vembutech Aug 18 '16 at 12:40
  • It did not work for me either – mosquetero Aug 18 '16 at 12:44
  • 1
    interfaces are connected to the same OVS bridge - that's your problem. – Michal Sokolowski Aug 18 '16 at 14:57
2

When routing use the FORWARD table:

iptables -A FORWARD -p icmp -m icmp --icmp-type 8 -j DROP
Improve this answer
  • Ok, but in the nat tables I cannot use DROP or REJECT as an action, so how would you block those ping packets? – mosquetero Aug 18 '16 at 12:02
  • Don't use DROP, simply do not MASQUERADE! iptables -A POSTROUTING -t nat ! -p icmp -j MASQUERADE – Ipor Sircer Aug 18 '16 at 12:14
  • ok, but that does not really drop the packet right? It just makes sure that the packet will never arrive to its destination. So you are telling me that it is not possible to DROP / REJECT the packet unless specified in the iptables of the node which is the source of the ping, right? – mosquetero Aug 18 '16 at 13:49
  • DROP means: if received this kind of packet then DROP to /dev/null. if the packet is not MASQUERADEd, then the packet will be dropped to /dev/null. What's the difference? – Ipor Sircer Aug 18 '16 at 13:55
  • AFAIK, if the packet is not MASQUERADE then it will be drop in the network because it will have a source IP which is unknown (e.g. a private source IP) but I don't think it goes to /dev/null. If I ping 8.8.8.8 from a private IP of the VM (let's say 192.168.0.2) and I don't masquerade then I see: 16:14:55.824893 IP 192.168.0.2 > 8.8.8.8: ICMP echo request, id 10300, seq 1, length 64 16:14:56.831380 IP 192.168.0.2 > 8.8.8.8: ICMP echo request, id – mosquetero Aug 18 '16 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.