ICMP is enabled by default on red

Indeed, cfusco is correct firewall.local is the place to put such a rule. If you really wish to stop a reply to ping on the red but keep it available on the everywhere else. In teaching myself iptables, I played around with some of this, so here is a suggestion. In /etc/sysconfig/firewall.local under the start section on could put the following:

    iptables -A CUSTOMINPUT -p icmp --icmp-type 8 -i red0 -j DROP

and then under the stop section put:

    iptables -F CUSTOMINPUT

This will stop any ping responses from your ipfirebox back to the internet and allow ping on green and allow you to ping out to the internet. I have tested such a firewall rule and it seems to work.

It seems to me that there is some debate about whether turning off ping replies are good or bad. Maybe someone with more knowledge could weight in on the merits of one verses the other. Such an argument might also depend on how you are geo-located, that is some areas might be more prone to attack than others. Hope this helps. PZ

2 Likes