Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Shorewall - DROP ICMP pings
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
A.S. Pushkin
Guru
Guru


Joined: 09 Nov 2002
Posts: 307
Location: dx/dt, dy/dt, dz/dt, t

PostPosted: Fri Aug 25, 2017 6:33 pm    Post subject: Shorewall - DROP ICMP pings Reply with quote

I've upgraded shorewall and have run into a problem.

I'm unsure how others consider it, but I often visit www.grc.com to test my firewall.

I usually pass, but now I am unable to pass the ping test. I've searched for configurations,
but have been unsuccessful correcting this.

TIA
_________________
ASPushkin

"In a time of universal deceit - telling the truth is a revolutionary act." -- George Orwell
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 43755
Location: 56N 3W

PostPosted: Fri Aug 25, 2017 9:16 pm    Post subject: Reply with quote

A.S. Pushkin,

I have a policy of DROP everywhere, so everything going anywhere is thrown away unless its explicitly permitted, or DENYed if I want to be friendly and log the packet.
This stops the nasties phoning home if they do get in. Its more trouble to set up but to me, its worth the extra security.

My rule
Code:
# fw accepts from the internet - its anti social to drop ping
ACCEPT          any             any                     icmp    echo-request
allows pings.

Change the ACCEPT, to DROP to throw away pings.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
A.S. Pushkin
Guru
Guru


Joined: 09 Nov 2002
Posts: 307
Location: dx/dt, dy/dt, dz/dt, t

PostPosted: Wed Aug 30, 2017 5:37 pm    Post subject: Shorewall - DROP ICMP pings Reply with quote

Thanks NeddySeagoon. I have tried your suggestion and the problem persists.

Until recent upgrades to shorewall this problem did not occur. I know many do not like the shieldsup test at grc.com
but it allows me some test. My box passes the Solicited TCP Packets and Unsolicited Packets, but not ping reply.

I must confess this is an area I'm weak in and I'm perplexed as to how to fix it. I'm wondering if I should pursue
another firewall application.

Thanks
_________________
ASPushkin

"In a time of universal deceit - telling the truth is a revolutionary act." -- George Orwell
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 43755
Location: 56N 3W

PostPosted: Wed Aug 30, 2017 5:51 pm    Post subject: Reply with quote

A.S. Pushkin,

Pings are not a threat. You may want them yourself one day.

If you care to share your /etc/shorewall/policy and /etc/shorewall/rules files, I'll look them over.

I use both shorewall and shorewall6. They are not firewall applications, they write iptables rules and iptables provides the firewall.
Think of shorewall as a rules compiler for iptables.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum