{"id":1719,"date":"2011-10-04T19:30:44","date_gmt":"2011-10-04T19:30:44","guid":{"rendered":"http:\/\/www.tom-nan.com\/?p=1719"},"modified":"2011-10-04T19:30:44","modified_gmt":"2011-10-04T19:30:44","slug":"iptables-firewall-fun","status":"publish","type":"post","link":"https:\/\/tom-nan.com\/index.php\/2011\/10\/04\/iptables-firewall-fun\/","title":{"rendered":"iptables Firewall fun"},"content":{"rendered":"

WARNING:\u00a0 This is a technical geeky post my Internet firewall… friends and family not interested need to read no further…<\/span><\/strong>
\nFor friends and family still with me here, iptables is the software in my Internet firewall that keeps the big bad Internet hackers from poking at my computers and causing problems.
\nI’ve been studying\u00a0 the docs and looking at other people’s examples around cyberspace and got it working…\u00a0 One ot the problems I’ve run into was when I tried to ping out to the world.\u00a0 if I tried to ping www.google.com I got this message back:
\nping: sendmsg: operation not permitted
\nI’m running ubuntu server 10.04LTS as a border gateway\/firewall.\u00a0 Lots of discussion on the net, and a few gave me clues but didn’t solve the problem…\u00a0 The hints were that it was a firewall issue… ok.. no worries…\u00a0 here is the code I used to fix the problem:<\/p>\n

iptables -A OUTPUT -o $extif -p icmp –icmp-type 0 -j ACCEPT<\/p>\n

iptables -A OUTPUT -o $extif -p icmp –icmp-type 8 -j ACCEPT<\/p>\n

iptables -A INPUT -i $extif -p icmp –icmp-type 0 -m limit –limit 10\/s -j ACCEPT<\/p>\n

iptables -A INPUT -i $extif -p icmp –icmp-type 8 -m limit –limit 1\/s -j ACCEPT<\/p>\n

The problem I had was I couldn’t remember which icmp type was the echo request and which was the echo reply… Time to look at the RFC (for friends and family, RFCs are “Requests For Comments”).\u00a0 They are the specifications on how the Internet works.\u00a0 Ping uses a language called ICMP or “Internet Control Message Protocol” and ICMP is just one of MANY specifications out there.\u00a0 Turns out that the pings I was sending out were being blocked by my own firewall. A ping, known as an echo-request, is type 8 in the spec. The responses, known as echo-replies are type 0 in the spec. I had them backwards.\u00a0 So I fixed it once I figured the problem out, and set it up so my system can also respond to pings from my ISP but you’ll notice I’m limiting stuff on my input to prevent misuse by people on the outside…\u00a0 The four lines above do the following:
\nLine 1:\u00a0 Allows my machine to send out ping replies.
\nLine 2: Allows me to send out ping requests
\nLine 3: Allows replies to pings I send out to come back.\u00a0 I’m limiting the replies in case a hacker tries to flood me with unsolicited replies.
\nLine 4: Limits incoming ping requests, I’m limiting these to prevent hackers from flooding me with ping requests.
\nNow when I send pings out I get the replies back instead of bombing out with an error. I don’t claim the limiting I’ve implemented will stop all abuse that hackers might dish out, but it will slow them down enough so our home network will stay up instead of going down cold.<\/p>\n","protected":false},"excerpt":{"rendered":"

WARNING:\u00a0 This is a technical geeky post my Internet firewall… friends and family not interested need to read no further… For friends and family still with me here, iptables is the software in my Internet firewall that keeps the big bad Internet hackers from poking at my computers and causing problems. I’ve been studying\u00a0 the … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,28],"tags":[],"class_list":["post-1719","post","type-post","status-publish","format-standard","hentry","category-computer-help","category-technology"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/tom-nan.com\/index.php\/wp-json\/wp\/v2\/posts\/1719","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tom-nan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tom-nan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tom-nan.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tom-nan.com\/index.php\/wp-json\/wp\/v2\/comments?post=1719"}],"version-history":[{"count":0,"href":"https:\/\/tom-nan.com\/index.php\/wp-json\/wp\/v2\/posts\/1719\/revisions"}],"wp:attachment":[{"href":"https:\/\/tom-nan.com\/index.php\/wp-json\/wp\/v2\/media?parent=1719"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tom-nan.com\/index.php\/wp-json\/wp\/v2\/categories?post=1719"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tom-nan.com\/index.php\/wp-json\/wp\/v2\/tags?post=1719"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}