ICMP rule for stateful firewall

ICMP rule for stateful firewall

[Visham Ramsurrun]

Hi to all,

I wanted to ask if such a rule was possible:

iptables -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d
192.168.10.0/24 -m state --state NEW,ESTABLISHED,RELATED -p icmp
--icmp-type echo request -j ACCEPT

Regards,
Visham

Re: ICMP rule for stateful firewall

[Taylor, Grant]

> I wanted to ask if such a rule was possible:
> 
> iptables -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d
> 192.168.10.0/24 -m state --state NEW,ESTABLISHED,RELATED -p icmp
> --icmp-type echo request -j ACCEPT

Yes, such a rule seems valid as in there are no syntax errors.  However I think this type of rule is a bit odd to see.  The fact that you are coming in and doing out the same interface does not bother me, but the fact that your source and destination are on the same subnet perplexes me.  Normally this sort of operation would be reserved for a single physical LAN subnet.  I have seen such traffic before, namely when I used a DNAT to redirect web traffic from a LAN back in to a proxy on the same LAN.  (This was used to thwart people that tried to bypass the proxy on the LAN.)  I find it a little odd that you would need ICMP traffic from the local LAN destined to the local LAN to pass through your router, but hey, I'm not saying that it would never happen.  Based on your rule ICMP traffic from someone on your local LAN on eth0 with a source IP in the 192.168.10.0/24 subnet destined to your 
 local LAN on eth0 with a destination IP in the 192.168.10.0 subnet *SHOULD* work just fin
d.



Grant. . . .

Re: ICMP rule for stateful firewall

[Jason Opperisano]

On Mon, May 09, 2005 at 02:15:51PM +0400, Visham Ramsurrun wrote:
> Hi to all,
> 
> I wanted to ask if such a rule was possible:
> 
> iptables -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d
> 192.168.10.0/24 -m state --state NEW,ESTABLISHED,RELATED -p icmp
> --icmp-type echo request -j ACCEPT

first, it's "echo-request" not "echo request"

grant already covered all the idiosyncrasies of having the same inbound
and outbound interface and the same layer3 subnet pretty thoroughly.
the only thing i'll add is that i can't think of a situation where an
ICMP echo-request packet would be marked RELATED or ESTABLISHED by the
conntrack code.  in the case of a normal ping, ICMP echo-requests are
NEW, and ICMP echo-replies are ESTABLISHED.

i guess given grant's and my comments; i'd say, while that rule is
"possible" i don't see the point of it, and i question whether it meets
the intended purpose.

-j

--
"Stewie: Careful! You're washing a baby's scalp, not scrubbing
 the vomit out of a Christmas dress, you stupid holiday drunk."
        --Family Guy