2002-12-28 16:38:03 +01:00
|
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
|
|
|
<html>
|
|
|
|
|
<head>
|
|
|
|
|
<title>ICMP Echo-request (Ping)</title>
|
|
|
|
|
<meta http-equiv="content-type"
|
|
|
|
|
content="text/html; charset=ISO-8859-1">
|
|
|
|
|
<meta name="author" content="Tom Eastep">
|
|
|
|
|
</head>
|
2003-10-07 00:38:40 +02:00
|
|
|
<body>
|
2002-12-28 16:38:03 +01:00
|
|
|
<table border="0" cellpadding="0" cellspacing="0"
|
|
|
|
|
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
2003-07-22 00:06:18 +02:00
|
|
|
id="AutoNumber1" bgcolor="#3366ff" height="90">
|
2003-10-07 00:38:40 +02:00
|
|
|
<tbody>
|
|
|
|
|
<tr>
|
|
|
|
|
<td width="100%">
|
2002-12-28 16:38:03 +01:00
|
|
|
<h1 align="center"><font color="#ffffff">ICMP Echo-request (Ping)</font></h1>
|
2003-10-07 00:38:40 +02:00
|
|
|
</td>
|
|
|
|
|
</tr>
|
|
|
|
|
</tbody>
|
2002-12-28 16:38:03 +01:00
|
|
|
</table>
|
2003-10-07 00:38:40 +02:00
|
|
|
<br>
|
|
|
|
|
Shorewall 'Ping' management has evolved over time with the latest
|
|
|
|
|
change coming in Shorewall version 1.4.0. To find out which version of
|
|
|
|
|
Shorewall you are running, at a shell prompt type "<font color="#009900"><b>/sbin/shorewall
|
|
|
|
|
version</b></font>". If that command gives you an error, it's time to
|
|
|
|
|
upgrade since you have a very old version of Shorewall installed (1.2.4
|
|
|
|
|
or earlier).<br>
|
2003-03-18 16:16:33 +01:00
|
|
|
<h2>Shorewall Versions >= 1.4.0</h2>
|
2003-10-07 00:38:40 +02:00
|
|
|
In Shoreall 1.4.0 and later version, ICMP echo-request's are treated
|
|
|
|
|
just like any other connection request.<br>
|
|
|
|
|
<br>
|
|
|
|
|
In order to accept ping requests from zone z1 to zone z2 where the
|
|
|
|
|
policy for z1 to z2 is not ACCEPT, you need a rule in
|
|
|
|
|
/etc/shoreall/rules of the form:<br>
|
|
|
|
|
<blockquote>ACCEPT <i>z1
|
|
|
|
|
z2 </i>icmp 8<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
Example: <br>
|
|
|
|
|
<br>
|
|
|
|
|
To permit ping from the local zone to the firewall:<br>
|
|
|
|
|
<blockquote>ACCEPT loc
|
|
|
|
|
fw icmp 8<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
If you would like to accept 'ping' by default even when the relevant
|
|
|
|
|
policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it
|
|
|
|
|
doesn't already exist and in that file place the following command:<br>
|
|
|
|
|
<blockquote>
|
2003-03-18 16:16:33 +01:00
|
|
|
<pre><b><font color="#009900">run_iptables -A icmpdef -p icmp --icmp-type 8 -j ACCEPT<br></font></b></pre>
|
2003-10-07 00:38:40 +02:00
|
|
|
</blockquote>
|
|
|
|
|
With that rule in place, if you want to ignore 'ping' from z1 to z2
|
|
|
|
|
then you need a rule of the form:<br>
|
|
|
|
|
<blockquote>DROP <i>z1
|
|
|
|
|
z2 </i>icmp 8<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
Example:<br>
|
|
|
|
|
<br>
|
|
|
|
|
To drop ping from the internet, you would need this rule in
|
|
|
|
|
/etc/shorewall/rules:<br>
|
|
|
|
|
<br>
|
|
|
|
|
<blockquote>DROP net
|
|
|
|
|
fw icmp 8<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
<h2>Shorewall Versions >= 1.3.14 and < 1.4.0 with
|
|
|
|
|
OLD_PING_HANDLING=No in /etc/shorewall/shorewall.conf</h2>
|
|
|
|
|
In 1.3.14, Ping handling was put under control of the rules and
|
|
|
|
|
policies just like any other connection request. In order to accept
|
|
|
|
|
ping requests from zone z1 to zone z2 where the policy for z1 to z2 is
|
|
|
|
|
not ACCEPT, you need a rule in /etc/shoreall/rules of the form:<br>
|
|
|
|
|
<blockquote>ACCEPT <i>z1
|
|
|
|
|
z2 </i>icmp 8<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
Example: <br>
|
|
|
|
|
<br>
|
|
|
|
|
To permit ping from the local zone to the firewall:<br>
|
|
|
|
|
<blockquote>ACCEPT loc
|
|
|
|
|
fw icmp 8<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
If you would like to accept 'ping' by default even when the relevant
|
|
|
|
|
policy is DROP or REJECT, create <b>/etc/shorewall/icmpdef </b>if it
|
|
|
|
|
doesn't already exist and in that file place the following command:<br>
|
|
|
|
|
<blockquote>
|
2003-02-08 21:48:47 +01:00
|
|
|
<pre><b><font color="#009900">run_iptables -A icmpdef -p icmp --icmp-type 8 -j ACCEPT<br></font></b></pre>
|
2003-10-07 00:38:40 +02:00
|
|
|
</blockquote>
|
|
|
|
|
With that rule in place, if you want to ignore 'ping' from z1 to z2
|
|
|
|
|
then you need a rule of the form:<br>
|
|
|
|
|
<blockquote>DROP <i>z1
|
|
|
|
|
z2 </i>icmp 8<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
Example:<br>
|
|
|
|
|
<br>
|
|
|
|
|
To drop ping from the internet, you would need this rule in
|
|
|
|
|
/etc/shorewall/rules:<br>
|
|
|
|
|
<blockquote>DROP net
|
|
|
|
|
fw icmp 8<br>
|
|
|
|
|
</blockquote>
|
|
|
|
|
<span style="font-weight: bold;">NOTE: </span>There is one
|
|
|
|
|
exception to the above description. In 1.3.14 and 1.3.14a, ping from
|
|
|
|
|
the firewall itself is enabled unconditionally. This suprising
|
|
|
|
|
"feature" was removed in version 1.4.0.<br>
|
|
|
|
|
<blockquote> </blockquote>
|
|
|
|
|
<blockquote> </blockquote>
|
|
|
|
|
<h2>Shorewall Versions < 1.3.14 or with OLD_PING_HANDLING=Yes in
|
|
|
|
|
/etc/shorewall/shorewall.conf<br>
|
|
|
|
|
</h2>
|
|
|
|
|
There are several aspects to the old Shorewall Ping management:<br>
|
2002-12-28 16:38:03 +01:00
|
|
|
<ol>
|
2003-10-07 00:38:40 +02:00
|
|
|
<li>The <b>noping</b> and <b>filterping </b>interface options in <a
|
|
|
|
|
href="Documentation.htm#Interfaces">/etc/shorewall/interfaces</a>.</li>
|
|
|
|
|
<li>The <b>FORWARDPING</b> option in<a href="Documentation.htm#Conf">
|
|
|
|
|
/etc/shorewall/shorewall.conf</a>.</li>
|
|
|
|
|
<li>Explicit rules in <a href="Documentation.htm#Rules">/etc/shorewall/rules</a>.</li>
|
2002-12-28 16:38:03 +01:00
|
|
|
</ol>
|
2003-10-07 00:38:40 +02:00
|
|
|
There are two cases to consider:<br>
|
2002-12-28 16:38:03 +01:00
|
|
|
<ol>
|
2003-10-07 00:38:40 +02:00
|
|
|
<li>Ping requests addressed to the firewall itself; and</li>
|
|
|
|
|
<li>Ping requests being forwarded to another system. Included here
|
|
|
|
|
are all cases of packet forwarding including NAT, DNAT rule, Proxy ARP
|
|
|
|
|
and simple routing.</li>
|
2002-12-28 16:38:03 +01:00
|
|
|
</ol>
|
2003-10-07 00:38:40 +02:00
|
|
|
These cases will be covered separately.<br>
|
2003-02-08 21:48:47 +01:00
|
|
|
<h3>Ping Requests Addressed to the Firewall Itself</h3>
|
2003-10-07 00:38:40 +02:00
|
|
|
For ping requests addressed to the firewall, the sequence is as follows:<br>
|
2002-12-28 16:38:03 +01:00
|
|
|
<ol>
|
2003-10-07 00:38:40 +02:00
|
|
|
<li>If neither <b>noping</b> nor <b>filterping </b>are specified
|
|
|
|
|
for the interface that receives the ping request then the request will
|
|
|
|
|
be responded to with an ICMP echo-reply.</li>
|
|
|
|
|
<li>If <b>noping</b> is specified for the interface that receives
|
|
|
|
|
the ping request then the request is ignored.</li>
|
|
|
|
|
<li>If <b>filterping </b>is specified for the interface then the
|
|
|
|
|
request is passed to the rules/policy evaluation.</li>
|
2002-12-28 16:38:03 +01:00
|
|
|
</ol>
|
2003-02-08 21:48:47 +01:00
|
|
|
<h3>Ping Requests Forwarded by the Firewall</h3>
|
2003-10-07 00:38:40 +02:00
|
|
|
These requests are <b>always</b> passed to rules/policy evaluation.<br>
|
2003-02-08 21:48:47 +01:00
|
|
|
<h3>Rules Evaluation</h3>
|
2003-10-07 00:38:40 +02:00
|
|
|
Ping requests are ICMP type 8. So the general rule format is:<br>
|
|
|
|
|
<br>
|
|
|
|
|
<i>Target
|
|
|
|
|
Source Destination </i>icmp
|
|
|
|
|
8<br>
|
|
|
|
|
<br>
|
|
|
|
|
Example 1. Accept pings from the net to the dmz (pings are responded to
|
|
|
|
|
with an ICMP echo-reply):<br>
|
|
|
|
|
<br>
|
|
|
|
|
ACCEPT net
|
|
|
|
|
dmz icmp 8<br>
|
|
|
|
|
<br>
|
|
|
|
|
Example 2. Drop pings from the net to the firewall<br>
|
|
|
|
|
<br>
|
|
|
|
|
DROP net
|
|
|
|
|
fw icmp 8<br>
|
2003-02-08 21:48:47 +01:00
|
|
|
<h3>Policy Evaluation</h3>
|
2003-10-07 00:38:40 +02:00
|
|
|
If no applicable rule is found, then the policy for the source to
|
|
|
|
|
the destination is applied.<br>
|
2002-12-28 16:38:03 +01:00
|
|
|
<ol>
|
2003-10-07 00:38:40 +02:00
|
|
|
<li>If the relevant policy is ACCEPT then the request is responded to
|
|
|
|
|
with an ICMP echo-reply.</li>
|
|
|
|
|
<li>If <b>FORWARDPING</b> is set to Yes in
|
|
|
|
|
/etc/shorewall/shorewall.conf then the request is responded to with an
|
|
|
|
|
ICMP echo-reply.</li>
|
|
|
|
|
<li>Otherwise, the relevant REJECT or DROP policy is used and the
|
|
|
|
|
request is either rejected or simply ignored.</li>
|
2002-12-28 16:38:03 +01:00
|
|
|
</ol>
|
2003-10-07 00:38:40 +02:00
|
|
|
<div style="text-align: justify;"><font size="2">Updated 8/23/2003 - <a
|
|
|
|
|
href="support.htm">Tom Eastep</a></font></div>
|
|
|
|
|
<p><font size="2"> </font></p>
|
|
|
|
|
<p><a href="copyright.htm"><font size="2">Copyright</font> © <font
|
2003-07-22 00:06:18 +02:00
|
|
|
size="2">2001, 2002, 2003 Thomas M. Eastep.</font></a><br>
|
2003-10-07 00:38:40 +02:00
|
|
|
</p>
|
|
|
|
|
<br>
|
2002-12-28 16:38:03 +01:00
|
|
|
</body>
|
|
|
|
|
</html>
|
