ICMP Parameters and my iptables table

The Internet Control Message Protocol (ICMP) has many messages that are identified by a "type" field. I use the types to specify what actions to take in my custom iptables config. My iptables configuration has a separate table for icmp traffic. This way icmp traffic is handled on it's own. I create the table in /etc/sysconfig/iptables: :icmp-in - [0:0] :icmp-out - [0:0] Then I create some allow rules so that all icmp traffic is allowed within my own network, adding the first rule for lo (loopback) is really important if you are going to start blocking icmp. The last two rules here allow icmp traffic outbound and any subsequent inbound traffic (established, related). -A INPUT -i lo -p icmp -j icmp-in -A INPUT -p icmp --icmp-type 8 -s -i eth0 -j ACCEPT -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT Next I go down the table of codes (see the end of this post) and decide if I want to accept, reject or return the packets based on type. -A icmp-in -p icmp -m icmp --icmp-type 0 -j ACCEPT -A icmp-in -p icmp -m icmp --icmp-type 3 -j RETURN -A icmp-in -p icmp -m icmp --icmp-type 4 -j RETURN -A icmp-in -p icmp -m icmp --icmp-type 8 -j ACCEPT -A icmp-in -p icmp -m icmp --icmp-type 11 -j RETURN -A icmp-in -p icmp -m icmp --icmp-type 12 -j RETURN -A icmp-in -p icmp -m icmp --icmp-type 14 -j RETURN -A icmp-in -p icmp -m icmp --icmp-type 16 -j RETURN -A icmp-in -p icmp -m icmp --icmp-type 18 -j RETURN -A icmp-out -p icmp -m icmp --icmp-type 0 -j ACCEPT -A icmp-out -p icmp -m icmp --icmp-type 4 -j RETURN -A icmp-out -p icmp -m icmp --icmp-type 8 -j ACCEPT -A icmp-out -p icmp -m icmp --icmp-type 12 -j RETURN -A icmp-out -p icmp -m icmp --icmp-type 13 -j RETURN -A icmp-out -p icmp -m icmp --icmp-type 15 -j RETURN -A icmp-out -p icmp -m icmp --icmp-type 17 -j RETURN Many ICMP types have a "code" field. Here is a list of the types with their assigned code fields. Information Reply
0 No Code
0Echo Reply
0 No Code
3Destination Unreachable
0 Net Unreachable
1 Host Unreachable
2 Protocol Unreachable
3 Port Unreachable
4 Fragmentation Needed and Don't Fragment was Set
5 Source Route Failed
6 Destination Network Unknown
7 Destination Host Unknown
8 Source Host Isolated
9 Communication with Destination Network is Administratively Prohibited
10 Communication with Destination Host is Administratively Prohibited
11 Destination Network Unreachable for Type of Service
12 Destination Host Unreachable for Type of Service
13 Communication Administratively Prohibited
14 Host Precedence Violation
15 Precedence cutoff in effect
4Source Quench
0 No Code
0 Redirect Datagram for the Network (or subnet)
1 Redirect Datagram for the Host
2 Redirect Datagram for the Type of Service and Network
3 Redirect Datagram for the Type of Service and Host
6Alternate Host Address
0 Alternate Address for Host
0 No Code
9Router Advertisement
0 Normal router advertisement
16 Does not route common traffic
10Router Selection
0 No Code
11Time Exceeded
0 Time to Live exceeded in Transit
1 Fragment Reassembly Time Exceeded
12Parameter Problem
0 Pointer indicates the error
1 Missing a Required Option
2 Bad Length
0 No Code
14Timestamp Reply
0 No Code
15Information Request
0 No Code
17Address Mask Request
0 No Code
18Address Mask Reply
0 No Code
19Reserved (for Security)
20-29Reserved (for Robustness Experiment)
31Datagram Conversion Error
32Mobile Host Redirect
33IPv6 Where-Are-You
34IPv6 I-Am-Here
35Mobile Registration Request
36Mobile Registration Reply
0 = Bad SPI
1 = Authentication Failed
2 = Decompression Failed
3 = Decryption Failed
4 = Need Authentication
5 = Need Authorization

About the Author...

Slides from LISA 2019 Linux systems troubleshooting #LISA2019 https://t.co/D4dMKflK6R Tue Oct 29 05:59:30 +0000 2019

https://t.co/AGeihMALAv configuring grub2 with EFI Fri Sep 13 05:20:01 +0000 2019

I published a Thing on @thingiverse! https://t.co/IYpRyEb7Hz #thingalert Tue Jul 23 19:27:57 +0000 2019

Nokogiri install on MacOSX https://t.co/v3An0miW9L Fri Jul 12 15:06:49 +0000 2019

HTML email with plain mailer plugin on Jenkins https://t.co/Z6FSDMDjy8 Thu Jul 11 21:07:25 +0000 2019