Top Nav

IPTables – Filter ICMP Address Mask Request & Replies

Here’s how to filter or block ICMP address mask requests and replies.

On Redhat/CentOS, edit /etc/sysconfig/iptables and add the following lines

-A RH-Firewall-1-INPUT -p ICMP –icmp-type address-mask-request -j DROP
-A RH-Firewall-1-INPUT -p ICMP –icmp-type address-mask-reply -j DROP

and then run:

/sbin/iptables restart

Or run the following commands:

/sbin/iptables -I RH-Firewall-1-INPUT 1 -p ICMP –icmp-type address-mask-request -j DROP
/sbin/iptables -I RH-Firewall-1-INPUT 1 -p ICMP –icmp-type address-mask-reply -j DROP
/sbin/service iptables save

Recently on an Ubantu server we just added these lines to /etc/rc.local:

/sbin/iptables -I INPUT 1 -p ICMP –icmp-type address-mask-request -j DROP
/sbin/iptables -I INPUT 1 -p ICMP –icmp-type address-mask-reply -j DROP

Email
Print