iptables accepte de gèrer le ping

Article publié, le et modifié le
3 minute(s) de lecture

Cet article contient 565 mots.
Source brute de l'article : MD

Description

⇒ Règle simpliste :

iptables -A OUTPUT -o eth0 -p icmp -m conntrack --ctstate ! INVALID -j ACCEPT
iptables -A INPUT -i eth0 -p icmp -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

⇒ Règles plus fines :

Attention

Code : sh

iptables -A INPUT -p icmp -m icmp --icmp-type0 -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "ICMP Echo reply"
iptables -A INPUT -p icmp -m icmp --icmp-type3/0  -m conntrack --ctstate RELATED -j ACCEPT -m comment --comment "ICMP Destination Net Unreachable"
iptables -A INPUT -p icmp -m icmp --icmp-type3/1  -m conntrack --ctstate RELATED -j ACCEPT -m comment --comment "ICMP Destination Host Unreachable"
iptables -A INPUT -p icmp -m icmp --icmp-type8  -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -m comment --comment "ICMP Echo mssg"
iptables -A INPUT -s adr_ip_gw -p icmp -m icmp --icmp-type9 -m conntrack --ctstate RELATED -j ACCEPT -m comment --comment "ICMP Router Advert"
iptables -A INPUT -s adr_ip_gw -p icmp -m icmp --icmp-type10 -m conntrack --ctstate NEW -j ACCEPT -m comment --comment "ICMP Router Select"
iptables -A INPUT -p icmp -m icmp --icmp-type11  -m conntrack --ctstate RELATED -j ACCEPT -m comment --comment "ICMP Time exceeded"
iptables -A INPUT -p icmp -m icmp --icmp-type12  -m conntrack --ctstate RELATED -j ACCEPT -m comment --comment "ICMP Param pb"
iptables -A INPUT -p icmp -m icmp --icmp-type13  -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -m comment --comment "ICMP Timestamp mssg"
iptables -A INPUT -p icmp -m icmp --icmp-type14  -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "ICMP Timestamp reply"
iptables -A INPUT -p icmp -m icmp --icmp-type17  -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -m comment --comment "ICMP Addr Mask mssg"
iptables -A INPUT -s adr_ip_gw -p icmp -m icmp --icmp-type18  -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "ICMP Addr Mask reply"
iptables -A INPUT -p icmp -m icmp --icmp-type30  -m conntrack --ctstate NEW,RELATED -j ACCEPT -m comment --comment "ICMP Traceroute"

iptables -A OUTPUT -p icmp -m icmp --icmp-type0 -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type3/0 -m conntrack --ctstate RELATED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type3/1 -m conntrack --ctstate RELATED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type8 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -d adr_ip_gw -p icmp -m icmp --icmp-type9 -m conntrack --ctstate RELATED -j ACCEPT
iptables -A OUTPUT -d adr_ip_gw -p icmp -m icmp --icmp-type10 -m conntrack --ctstate NEW -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type11 -m conntrack --ctstate RELATED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type12 -m conntrack --ctstate RELATED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type13 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type14 -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type17 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -d adr_ip_gw -p icmp -m icmp --icmp-type18 -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type30 -m conntrack --ctstate NEW,RELATED -j ACCEPT

Je vous invite très fortement à lire ATTENTIVEMENT sur le filtrage d’ICMP sous Linux : Linux : firewall ICMP


J’ai écrit ce mémo, pour la première fois, sur mon autre site : “Mémoire Grise Libérée”.