Iptables Inbound ICMP

In this sample iptables_in_icmp_programs.cfg, we filter inbound ICMP message traffic.

///////////////////////////////////////////////////////////////////////////////
//
// iptables_in_icmp_programs.cfg
//
///////////////////////////////////////////////////////////////////////////////

        // IN_ICMP - filter inbound icmp messages
        
        =iptables -N IN_ICMP
        for sip in $PING; do
            =iptables -A IN_ICMP -p icmp --icmp-type echo-request -s $sip -j ACCEPT
            =iptables -A IN_ICMP -p icmp --icmp-type echo-reply   -s $sip -j ACCEPT
        done
        =iptables -A IN_ICMP -p icmp --icmp-type destination-unreachable -j ACCEPT
        =iptables -A IN_ICMP -p icmp --icmp-type source-quench -j ACCEPT
        =iptables -A IN_ICMP -p icmp --icmp-type time-exceeded -j ACCEPT
        =iptables -A IN_ICMP -p icmp --icmp-type parameter-problem -j ACCEPT
        =iptables -A IN_ICMP -j LOG --log-prefix "IPT IN ICMP: " =logopt
        =iptables -A IN_ICMP -j DROP

///////////////////////////////////////////////////////////////////////////////

This iptables_in_icmp_programs.cfg file is #included by the higher-level iptables_programs.cfg file.  In that file, we might have code invoking the IN_ICMP chain as follows:

        =iptables -A IN_NETWORK -p icmp -j IN_ICMP

For more examples, see Samples.