Re: Off Topic: iptables, ping, traceroute
On Mon, Jul 16, 2001 at 02:30:29PM -0500, William Jensen wrote:
> I've setup a fairly restrictive set of rules for iptables and have been,
> up to this point, extremely satisfied with its performance. However,
> I've recently started having some signifiant issues with my cable modem
> provider and they routinely want to ping and traceroute to my machine.
> This requires me to take down my firewall and wait for them to finish,
> then put it back up. I'd like to make, as part of my rule set, ping and
> traceroute able to get through. So far I've done this for my input chain
> for ping
>
> -A INPUT -p icmp -j ACCEPT
>
> For traceroute I've done this:
>
> -A INPUT -p ip -j ACCEPT
>
> These appear to work, however, am I overlooking something from a
> security
> point of view by allowing any icmp and ip's through? Is there a
> better
> way?
You could further limit your rules by specifying the source
address of you cable modem provider, something like:
-A INPUT -p icmp -s provider.cable.net -j ACCEPT
Just figure out from your logs what ip address(es) they use
for their pings, and then they will be able to ping you as
they please, but nobody else will be able to.
--
John Patton patton66@home.com
Get my GnuPG public key: finger john@24.22.215.225
"A conservative is a man who believes that nothing should
be done for the first time." - Alfred E. Wiggam
Reply to: