Description
⇒ Règle simpliste :
iptables -A OUTPUT -o eth0 -p icmp -m conntrack --ctstate ! INVALID -j ACCEPT
iptables -A INPUT -i eth0 -p icmp -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
⇒ Règles plus fines :
Attention
ATTENTION :
Remplacez la mention adr_ip_gw par l’adresse ip de votre routeur/passerelle…
celle-ci est précisée comme source ou destination parce que ce type d’ICMP
ne doit être envoyé ou reçu que de votre passerelle.
Code : sh
iptables -A INPUT -p icmp -m icmp --icmp-type0 -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "ICMP Echo reply"
iptables -A INPUT -p icmp -m icmp --icmp-type3/0 -m conntrack --ctstate RELATED -j ACCEPT -m comment --comment "ICMP Destination Net Unreachable"
iptables -A INPUT -p icmp -m icmp --icmp-type3/1 -m conntrack --ctstate RELATED -j ACCEPT -m comment --comment "ICMP Destination Host Unreachable"
iptables -A INPUT -p icmp -m icmp --icmp-type8 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -m comment --comment "ICMP Echo mssg"
iptables -A INPUT -s adr_ip_gw -p icmp -m icmp --icmp-type9 -m conntrack --ctstate RELATED -j ACCEPT -m comment --comment "ICMP Router Advert"
iptables -A INPUT -s adr_ip_gw -p icmp -m icmp --icmp-type10 -m conntrack --ctstate NEW -j ACCEPT -m comment --comment "ICMP Router Select"
iptables -A INPUT -p icmp -m icmp --icmp-type11 -m conntrack --ctstate RELATED -j ACCEPT -m comment --comment "ICMP Time exceeded"
iptables -A INPUT -p icmp -m icmp --icmp-type12 -m conntrack --ctstate RELATED -j ACCEPT -m comment --comment "ICMP Param pb"
iptables -A INPUT -p icmp -m icmp --icmp-type13 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -m comment --comment "ICMP Timestamp mssg"
iptables -A INPUT -p icmp -m icmp --icmp-type14 -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "ICMP Timestamp reply"
iptables -A INPUT -p icmp -m icmp --icmp-type17 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -m comment --comment "ICMP Addr Mask mssg"
iptables -A INPUT -s adr_ip_gw -p icmp -m icmp --icmp-type18 -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "ICMP Addr Mask reply"
iptables -A INPUT -p icmp -m icmp --icmp-type30 -m conntrack --ctstate NEW,RELATED -j ACCEPT -m comment --comment "ICMP Traceroute"
iptables -A OUTPUT -p icmp -m icmp --icmp-type0 -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type3/0 -m conntrack --ctstate RELATED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type3/1 -m conntrack --ctstate RELATED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type8 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -d adr_ip_gw -p icmp -m icmp --icmp-type9 -m conntrack --ctstate RELATED -j ACCEPT
iptables -A OUTPUT -d adr_ip_gw -p icmp -m icmp --icmp-type10 -m conntrack --ctstate NEW -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type11 -m conntrack --ctstate RELATED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type12 -m conntrack --ctstate RELATED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type13 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type14 -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type17 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -d adr_ip_gw -p icmp -m icmp --icmp-type18 -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type30 -m conntrack --ctstate NEW,RELATED -j ACCEPT
Je vous invite très fortement à lire ATTENTIVEMENT sur le filtrage d’ICMP sous Linux : Linux : firewall ICMP
J’ai écrit ce mémo, pour la première fois, sur mon autre site : “Mémoire Grise Libérée”.