On Tue, 26 Nov 2002, Jeff A. Earickson wrote:
> Hi,
> I've searched the mailing list archives, and the how-tos, and
> didn't find a clear answer to the question of "block everything,
> yet allow ping and traceroute to the box to work". In short,
> I have:
>
> block in all
> block out all
>
> #---now we deal with ICMP packets
> #---let ping work
> pass in log quick on hme0 proto icmp from any to any icmp-type echo
> pass in log quick on hme0 proto icmp from any to any icmp-type echorep
> #---let traceroute work
> pass in log quick on hme0 proto icmp from any to any icmp-type 0
> pass in log quick on hme0 proto icmp from any to any icmp-type 11
>
> The ping part works, but not traceroute. Help...
>
> Also, in searching the keywords for icmp-type, I noticed "squench".
> Shouldn't that be either "squelch" or "quench"? Is this a new word?
traceroute uses UDP packets. Just read the man page of traceroute.
Interesting options
-P proto
Change the protocol being used from UDP to a numeric protocol or
a name as specified in /etc/protocols. This will not work reli-
ably for most protocols. If set to 1 (ICMP), then ICMP Echo Re-
quest messages will be used (same as ping(8)).
-I Equivalent to -P 1. Used for compatibility with other OSes.
-p port
Set the base UDP port number used in probes (default is 33434).
traceroute hopes that nothing is listening on UDP ports base to
base+nhops*nqueries-1 at the destination host (so an ICMP
PORT_UNREACHABLE message will be returned to terminate the route
tracing). If something is listening on a port in the default
range, this option can be used to pick an unused port range.
Cheers,
Dries
--
Dries Schellekens
email: [EMAIL PROTECTED]
