Ping problem with iptables

Nicodeemus · 2010-10-19 23:16:13

Hi all,

I have established a firewall for single machine using Iptables by copying the rules displayed here http://wiki.archlinux.org/index.php/Sim … l_firewall

I can browse internet with Epiphany, but cant ping to other valid hosts except my own loopback and IP adresses. My computer doesn't respond neither when I try to ping it from elsewhere. I suspect that I should at least add rules to OUTPUT chain, which would make possible to send icmp echo-reply and icmp echo-request. Sound kind of stupid articulating this without trying it myself, but I'm just getting so frustrated with this problem so figured out that a piece of advice from someone who is more familiar with iptables would do the trick smoother.

Recent rules look like this

GNU nano 2.2.4 File: /etc/iptables/iptables.rules
# Generated by iptables-save v1.4.9 on Wed Oct 20 01:04:54 2010
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:OPEN-TCP - [0:0]
:OPEN-UDP - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW -j ACCEPT
-A INPUT -p udp -m state --state NEW -j OPEN-UDP
-A INPUT -p tcp -m state --state NEW -j OPEN-TCP
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
-A INPUT -p tcp -m recent --set --name TCP-PORTSCAN --rsource -j REJECT --reject-with tcp-reset
-A INPUT -p udp -m recent --set --name UDP-PORTSCAN --rsource -j REJECT --reject-with icmp-port-unreachable
-A OPEN-TCP -p tcp -m recent --update --seconds 60 --name TCP-PORTSCAN --rsource -j REJECT --reject-with tcp-reset
-A OPEN-TCP -p tcp -m tcp --dport 80 -j ACCEPT
-A OPEN-UDP -p udp -m recent --update --seconds 60 --name UDP-PORTSCAN --rsource -j REJECT --reject-with icmp-port-unreachab$
-A OPEN-UDP -p udp -m udp --dport 53 -j ACCEPT
COMMIT
# Completed on Wed Oct 20 01:04:54 2010

Last edited by Nicodeemus (2010-10-20 16:53:21)

fukawi2 · 2010-10-20 01:47:17

That SHOULD work.
- Your OUTPUT policy is 'ACCEPT'
- Your INPUT rules allow ICMP type 8 (echo-request)

What is the output of:

cat /proc/sys/net/ipv4/icmp_echo_ignore_all

Nicodeemus · 2010-10-20 12:07:19

Thanks for swift answer fukawi2.

Output looks like this.

# cat /proc/sys/net/ipv4/icmp_echo_ignore_all
0

I also disabled iptables from /etc/rc.conf daemons array, so I'm guite sure that the problem is not related to iptables rules since this had no affect.

DAEMONS=(syslog-ng dbus hal gdm !iptables sshguard network netfs crond alsa)

Last edited by Nicodeemus (2010-10-20 12:42:54)

fukawi2 · 2010-10-20 22:16:50

Try forcing iptables to flush:

iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT

Does your ping work now?

Nicodeemus · 2010-10-21 11:08:33

fukawi2 wrote:

Try forcing iptables to flush:
iptables -P INPUT ACCEPT
iptables -F INPUT
iptables -P OUTPUT ACCEPT
iptables -F OUTPUT
Does your ping work now?

Executed those commands in the same order you wrote them. No success. I'm not sure can I shed any light to this by telling that i can ping google.com and other webservers. I cant ping normal desktop computers and my computer doesn't respond to pings.

Its now 2:10 PM where I live, thats why my responds come so late.

Last edited by Nicodeemus (2010-10-21 11:13:46)

fukawi2 · 2010-10-21 11:28:31

Oh, well that's a different story then.....

Can you arping them?

arping <address>

Maybe it's the other computers that don't respond to ping.

Nicodeemus · 2010-10-21 21:21:37

Arping doesn't work neither. Same thing with ping, can send packages but wont receive anything. Also tried to arping my friends computer without any success.

$ sudo arping -c 3 [url=http://www.google.com]www.google.com[/url]
Password: 
ARPING 74.125.43.104 from 192.168.65.120 eth0
Sent 3 probes (3 broadcast(s))
Received 0 response(s)

$ sudo arping -c 3 88.194.222.76
ARPING 80.194.222.76 from 192.168.65.120 eth0
Sent 3 probes (3 broadcast(s))
Received 0 response(s)

Last edited by Nicodeemus (2010-10-21 21:31:13)

fukawi2 · 2010-10-21 22:25:08

Nicodeemus wrote:

Arping doesn't work neither.

Sorry, I meant the other computers on your local network that you can't ping. Arping SHOULDN'T work for sites outside your local LAN.

thestinger · 2010-10-21 23:10:58

All outbound traffic is allowed, so the problem is with receiving the replies. Is eth0 your LAN interface? If it is, all inbound traffic is allowed too and the other rules aren't applied.

A few of your rules are out of order (the tcp and udp reject should be before the generic reject - but that wouldn't be causing this problem), and it looks like this line has a typo in it:

# (should be unreach or unreachable at the end)
-A OPEN-UDP -p udp -m recent --update --seconds 60 --name UDP-PORTSCAN --rsource -j REJECT --reject-with icmp-port-unreachab$

The Simple stateful firewall article needs a bit of work at the moment (I've fixed it up quite a bit, but there's still a lot to go).

If you want, you can base your rules off the iptables.rules I use, just change the open ports and local network address as needed (it's essentially the same as the current stateful firewall article, without the anti-portscanning stuff):

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:NEW - [0:0]
:TCP - [0:0]
:UDP - [0:0]
:ICMP - [0:0]

-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state --state NEW -j NEW

-A NEW -p udp -j UDP
-A NEW -p tcp -j TCP
-A NEW -p icmp -j ICMP
-A NEW -j REJECT --reject-with proto-unreach

-A TCP -p tcp ! --syn -j REJECT --reject-with tcp-rst
-A TCP -p tcp -m multiport --dports 53,17500 -s 192.168.2.0/24 -j ACCEPT # tcp ports open to local network (192.168.2.*)
-A TCP -p tcp -m multiport --dports 80,443,1720 -j ACCEPT # tcp ports open to internet
-A TCP -p tcp -j REJECT --reject-with tcp-rst

-A UDP -p udp -m multiport --dports 53,123,17500 -s 192.168.2.0/24 -j ACCEPT # udp ports open to local network (192.168.2.*)
-A UDP -p udp --dport 1720 -j ACCEPT # udp ports open to internet
-A UDP -p udp -j REJECT --reject-with port-unreach

-A ICMP -p icmp --icmp-type 8 -j ACCEPT # allow pings
-A ICMP -j DROP

COMMIT

Nicodeemus · 2010-10-24 18:43:49

Allright, flushed all the previous rules and committed recent rules almost like thestinger showed his. ICMP chain should be the latest chain, but it always jumps automatically behind the OUTPUT although I created NEW,TCP and UDP chains before ICMP. Is there a way to move the whole ICMP chain behind NEW,TCP and UDP chains?

I didn't add ports for LAN because all the computers behind my router use dhcp.

Also added eth0 as accepted interface since I couldn't browse web by allowing only lo interface.

Still, my computer wont reply to pings nor I get no answer when I ping normal desktop computers. Webservers answer of course since I can browse web.

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:ICMP - [0:0]
:NEW - [0:0]
:TCP - [0:0]
:UDP - [0:0]

-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state --state NEW -j NEW

-A ICMP -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A ICMP -j DROP

-A NEW -p udp -j UDP
-A NEW -p tcp -j TCP
-A NEW -p icmp -j ICMP
-A NEW -j REJECT --reject-with icmp-proto-unreachable

-A TCP -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with tcp-reset
-A TCP -p tcp -m multiport --dports 85,1002,3968 -j ACCEPT
-A TCP -p tcp -j REJECT --reject-with tcp-reset

-A UDP -p udp -m udp --dport 2071 -j ACCEPT
-A UDP -p udp -j REJECT --reject-with icmp-port-unreachable
COMMIT

Last edited by Nicodeemus (2010-10-24 19:33:12)

thestinger · 2010-10-24 19:41:06

The order of the chains doesn't matter, they work like functions in code (it just matters when you call them). iptables reads the rules from the top down, so you aren't doing any more filtering than you did without iptables set up (your eth0 rule allows ALL traffic from eth0).

It's likely your router is doing something wrong and breaking conntrack connection tracking, so stuff doesn't end up in RELATED/ESTABLISHED, which gets accepted (thus forcing you to add the eth0 rule).

I thought you were trying to ping a computer on your local network, but the ip address is public. It's perfectly normal for home routers to ignore pings. Can you ping www.google.com etc.?

Last edited by thestinger (2010-10-24 19:41:24)

fukawi2 · 2010-10-24 22:40:36

You're going off on a tangent here. There was nothing wrong with your original rules -- you were getting pings from google.com etc so ICMP and ping traffic is working fine.

The problem is pinging your internal computers on your LAN, no?

Nicodeemus · 2010-10-30 18:37:32

Yes, I went off on a tangent, but that because didn't know that its normal for home routers to block pings. And yes, I can ping google.com so guess there wasn't a problem in the first place. Sorry for making a lot of fuss from empty. Case closed.

Last edited by Nicodeemus (2010-10-30 18:38:03)

fukawi2 · 2010-10-31 09:17:00

Nicodeemus wrote:

Yes, I went off on a tangent, but that because didn't know that its normal for home routers to block pings. And yes, I can ping google.com so guess there wasn't a problem in the first place. Sorry for making a lot of fuss from empty. Case closed.

It was *only* your internal router that was blocking pings? They don't normally block on the *inside*.... Didn't you say you couldn't ping other Windows machines on your LAN?

Well if you're happy it's solved, then all good

Arch Linux

#1 2010-10-19 23:16:13

Ping problem with iptables

#2 2010-10-20 01:47:17

Re: Ping problem with iptables

#3 2010-10-20 12:07:19

Re: Ping problem with iptables

#4 2010-10-20 22:16:50

Re: Ping problem with iptables

#5 2010-10-21 11:08:33

Re: Ping problem with iptables

#6 2010-10-21 11:28:31

Re: Ping problem with iptables

#7 2010-10-21 21:21:37

Re: Ping problem with iptables

#8 2010-10-21 22:25:08

Re: Ping problem with iptables

#9 2010-10-21 23:10:58

Re: Ping problem with iptables

#10 2010-10-24 18:43:49

Re: Ping problem with iptables

#11 2010-10-24 19:41:06

Re: Ping problem with iptables

#12 2010-10-24 22:40:36

Re: Ping problem with iptables

#13 2010-10-30 18:37:32

Re: Ping problem with iptables

#14 2010-10-31 09:17:00

Re: Ping problem with iptables

Board footer