Catalogue
iptables Configuration to Allow ping

iptables Configuration to Allow ping

🌐 日本語で読む

Environment

  • CentOS 5.8

What We Want to Achieve

Server A allows ping only from Server B.

1
2
3
4
5
+----------+  Ping Request   +----------+
| | <-------------- | |
| Server A | | Server B |
| | --------------> | |
+----------+ Ping Response +----------+

Configuration to Allow ping from a Specific IP

Run the following configuration on Server A.

1
2
3
[Server A]# iptables -A INPUT -p icmp --icmp-type 8 -s <Server B の IP Address> -j ACCEPT
[Server A]# iptables -A OUTPUT -p icmp --icmp-type 0 -s <Server B の IP Address> -j ACCEPT
[Server A]# service iptables restart
  • --icmp-type 8 allows Echo request
  • --icmp-type 0 allows Echo Reply

Running ping from Server B

1
2
3
4
5
6
7
8
9
10
[Server B]# ping <Server A の IP Address>

PING (<Server A の IP Address>): 56 data bytes
64 bytes from (<Server A の IP Address>): icmp_seq=0 ttl=58 time=4.411 ms
64 bytes from (<Server A の IP Address>): icmp_seq=1 ttl=58 time=4.079 ms
64 bytes from (<Server A の IP Address>): icmp_seq=2 ttl=58 time=4.027 ms
^C
--- (<Server A の IP Address>) ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 4.027/4.172/4.411/0.170 ms

icmp-type List

Referenced from asahi-net Appendix C. ICMP Types below.

TYPECODEMeaningQueryErrorReference
00Echo ReplyxRFC792
30Network UnreachablexRFC792
31Host UnreachablexRFC792
32Protocol UnreachablexRFC792
33Port UnreachablexRFC792
34Fragmentation needed but no frag. bit setxRFC792
35Source routing failedxRFC792
36Destination network unknownxRFC792
37Destination host unknownxRFC792
38Source host isolated (obsolete)xRFC792
39Destination network administratively prohibitedxRFC792
310Destination host administratively prohibitedxRFC792
311Network unreachable for TOSxRFC792
312Host unreachable for TOSxRFC792
313Communication administratively prohibited by filteringxRFC1812
314Host precedence violationxRFC1812
315Precedence cutoff in effectxRFC1812
40Source quenchRFC792
50Redirect for networkRFC792
51Redirect for host
52Redirect for TOS and networkRFC792
53Redirect for TOS and hostRFC792
80Echo requestxRFC792
90Router advertisement - Normal router advertisementRFC1256
916Router advertisement - Does not route common trafficRFC2002
100Route selectionRFC1256
110TTL equals 0 during transitxRFC792
111TTL equals 0 during reassemblyxRFC792
120IP header bad (catchall error)xRFC792
121Required options missingxRFC1108
122IP Header bad lengthxRFC792
130Timestamp request (obsolete)xRFC792
14Timestamp reply (obsolete)xRFC792
150Information request (obsolete)xRFC792
160Information reply (obsolete)xRFC792
170Address mask requestxRFC950
180Address mask replyxRFC950
20-29Reserved for robustness experimentZaw-Sing Su
300TraceroutexRFC1393
310Datagram Conversion ErrorxRFC1475
320Mobile Host RedirectDavid Johnson
330IPv6 Where-Are-YouxBill Simpson
340IPv6 I-Am-HerexBill Simpson
350Mobile Registration RequestxBill Simpson
360Mobile Registration ReplyxBill Simpson
390SKIPTom Markson
400PhoturisRFC2521
kenzo0107

kenzo0107