Iptables Outbound ICMP

In this sample iptables_out_icmp_programs.cfg, we filter outbound ICMP message traffic.

///////////////////////////////////////////////////////////////////////////////
//
// iptables_out_icmp_programs.cfg
//
///////////////////////////////////////////////////////////////////////////////

        // OUT_ICMP - filter outbound icmp messages

        =iptables -N OUT_ICMP
        for dip in $PING; do
            =iptables -A OUT_ICMP -p icmp --icmp-type echo-request -d $dip -j ACCEPT
            =iptables -A OUT_ICMP -p icmp --icmp-type echo-reply -d $dip -j ACCEPT
        done
        =iptables -A OUT_ICMP -p icmp --icmp-type destination-unreachable -j ACCEPT
        =iptables -A OUT_ICMP -p icmp --icmp-type source-quench -j ACCEPT
        =iptables -A OUT_ICMP -p icmp --icmp-type parameter-problem -j ACCEPT
        =iptables -A OUT_ICMP -j LOG --log-prefix "IPT OUT ICMP: " =logopt
        =iptables -A OUT_ICMP -j DROP

///////////////////////////////////////////////////////////////////////////////

This iptables_out_icmp_programs.cfg file is #included by the higher-level iptables_programs.cfg file.  In that file, we might have code invoking the OUT_ICMP chain as follows:

        =iptables -A OUT_NETWORK -p icmp -j OUT_ICMP

For more examples, see Samples.