From: mitty Date: Tue, 7 Jul 2009 08:48:27 +0000 (+0000) Subject: * FIX: increase acceptable icmp packet size limit X-Git-Tag: r89-trunk~63 X-Git-Url: http://lab.mitty.jp/git/?a=commitdiff_plain;h=c8daa6983248628690543c953d99bad4dd6cb64d;p=lab.git * FIX: increase acceptable icmp packet size limit * ping 192.168.100.254 -n 1 {{{ PING 1 (0.0.0.1) 56(124) bytes of data. --- 1 ping statistics --- 23 packets transmitted, 0 received, 100% packet loss, time 22381ms }}} git-svn-id: https://lab.mitty.jp/svn/lab/trunk@15 7d2118f6-f56c-43e7-95a2-4bb3031d96e7 --- diff --git a/iptables/ufw/raw.rules b/iptables/ufw/raw.rules index 8b4a306..f379716 100644 --- a/iptables/ufw/raw.rules +++ b/iptables/ufw/raw.rules @@ -17,7 +17,7 @@ -A LOG_ICMP -j LOG --log-prefix "[UFW BLOCK BAD-ICMP]: " --log-level err -m limit --limit 3/min --limit-burst 10 -A LOG_ICMP -j DROP # Too large icmp requests --A PREROUTING -p icmp --icmp-type echo-request -m length --length 85: -j LOG_ICMP +-A PREROUTING -p icmp --icmp-type echo-request -m length --length 128: -j LOG_ICMP # Too many times of icmp requests (only 5 packets per second if over 10pkts/sec) -A PREROUTING -p icmp --icmp-type echo-request -m limit --limit 5/s --limit-burst 10 -j ACCEPT -A PREROUTING -p icmp --icmp-type echo-request -j LOG_ICMP