CentOS - Feb 2007 - HOW to enable traceroute with IPTABLES

Hi,

I am setting up a firewall on CENTOS 4.4.

I have done default block

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP


I have enabled ICMP to www.google.com

iptables -A OUTPUT -p icmp -d 64.233.189.104 -j ACCEPT
iptables -A INPUT -p icmp -s 64.233.189.104 -j ACCEPT

Ping works fine as below
[root at firebox rc.d]# ping 64.233.189.104
PING 64.233.189.104 ( 64.233.189.104) 56(84) bytes of data.
64 bytes from 64.233.189.104: icmp_seq=0 ttl=246 time=91.7 ms
64 bytes from 64.233.189.104: icmp_seq=1 ttl=246 time= 92.6 ms
64 bytes from 64.233.189.104: icmp_seq=2 ttl=246 time=93.2 ms
64 bytes from 64.233.189.104: icmp_seq=3 ttl=246 time=92.8 ms
64 bytes from 64.233.189.104: icmp_seq=4 ttl=246 time=91.4 ms
64 bytes from 64.233.189.104: icmp_seq=5 ttl=246 time=93.1 ms

But I still can not traceroute to that ip

Pls see below, as to when I try traceroute

[root at firebox rc.d]# traceroute 64.233.189.104
traceroute to 64.233.189.104 ( 64.233.189.104), 30 hops max, 38 byte packets
traceroute: sendto: Operation not permitted
 1 traceroute: wrote 64.233.189.104 38 chars, ret=-1
 *traceroute: sendto: Operation not permitted
traceroute: wrote 64.233.189.104 38 chars, ret=-1
 *traceroute: sendto: Operation not permitted
traceroute: wrote 64.233.189.104 38 chars, ret=-1
 *
traceroute: sendto: Operation not permitted
 2 traceroute: wrote 64.233.189.104 38 chars, ret=-1

WHY ,  Help needed.






-- 
Thank you
Indunil Jayasooriya


-- 
Thank you
Indunil Jayasooriya
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.centos.org/pipermail/centos/attachments/20070217/76c92cd6/attachment.html>

Indunil Jayasooriya (indunil75 at gmail.com) napisa?(a):
> Hi,
> 
> I am setting up a firewall on CENTOS 4.4.
> 
> 
> I have enabled ICMP to www.google.com
> 
> iptables -A OUTPUT -p icmp -d 64.233.189.104 -j ACCEPT
> iptables -A INPUT -p icmp -s 64.233.189.104 -j ACCEPT
> 
traceroute uses by default UDP with port 33434.

br


-- 
Marcin Mazurek

http://www.netsync.pl/  -  ::::  -  nic-hdl: MM3380-RIPE
GnuPG 6687 E661 98B0 AEE6 DA8B  7F48 AEE4 776F 5688 DC89

On 2/17/07, Indunil Jayasooriya <indunil75 at gmail.com>
wrote:
>But I still can not traceroute to that ip
>Pls see below, as to when I try traceroute
Keep in mind that traceroute is no longer universally supported as
several larger isps have blocked some icmp/udp functionality following
some windows exploits a few years ago. tcptraceroute seems far more
reliable to me these days.
-- 
During times of universal deceit, telling the truth becomes a revolutionary act.
George Orwell