Results 1 to 2 of 2

Thread: UFW block ICMP when I add a non ICMP related rule

  1. #1
    Join Date
    Nov 2009
    Beans
    13

    UFW block ICMP when I add a non ICMP related rule

    I am setting up a virtual server. Ubuntu 11.04, "minimal provider image".
    UFW was disabled by default. I set it to default deny. Allowed HTTP, SSH and other standard stuff, and enabled it. All seems to be OK. Adding one rule to block some annoying security scanners causes ping not to work. I'm not an Iptables expert, but it looks OK to me. I got it from some website, rather than invented it myself, but modified to to fit the ufw config file syntax. What in that rule prevents pings?!? It seems completely unrelated.

    -A ufw-before-input -d <MY-IP> -p tcp --dport 80 -m string --to 70 --algo bm --string 'GET /w00tw00t.at.ISC.SANS.' -j DROP

    If I don't add that line, but instead enable ufw without it, and afterward run directly:
    iptables -I INPUT -d <MY-IP> -p tcp --dport 80 -m string --to 70 --algo bm --string 'GET /w00tw00t.at.ISC.SANS.' -j DROP
    than all is fine.
    Last edited by MrMonster; May 21st, 2011 at 01:15 PM. Reason: Clarified test methodology.

  2. #2
    Join Date
    Nov 2009
    Beans
    13

    Re: UFW block ICMP when I add a non ICMP related rule

    OK, I've worked it out myself. The problem was that there was already a rule:

    iptables -I INPUT -d <MY-IP> -p tcp --dport 80 -m string --to 70 --algo bm --string 'GET /w00tw00t.at.ISC.SANS.' -j DROP

    stored in Iptables directly when I put the same rule in /etc/ufw/before.rules. It seems that the two cause conflicts, which, for reasons beyond me, prevented ping from working. Manually removing the rule from Iptables and reloading ufw did the trick.

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •