RE: Unable to block ICMP

["Rob Sterenborg" <rob@sterenborg.info>]

> Well, what I actually wanted (which I probably explained
> wrong) is that my ports that are not in use (closed) are
> being invisible (no ICMP echo). That better?

On the forum you are using this ruleset:

iptables -P INPUT ACCEPT
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -p tcp --dport 631 -j DROP
iptables -A INPUT -p tcp --dport 445 -j DROP
iptables -A INPUT -p tcp --dport 139 -j DROP
iptables -A INPUT -p tcp --dport 6000 -j DROP
iptables -A INPUT -p icmp -j DROP
iptables -A OUTPUT -p icmp -j DROP

Personally, I wouldn't want to do this. Why don't you DROP everything by
default and open up what you need, instead of ACCEPTing everything but
trying to DROP some ports/icmp?

Such ruleset would look like this:

$ipt -P INPUT DROP
[..ACCEPT rules here..]

Or like this:

[$ipt -P INPUT ACCEPT]
[..ACCEPT rules here..]
$ipt -A INPUT -j <DROP|REJECT [reject-with ...]>

IMHO that would be easier: for my IP, the website you mentioned shows
"steathed" (except for ports that I know are open) for the ports that
were scanned.


Grts,
Rob