Re: Rules for ICMP Type X Code Y

bgardner@iprotech.info
Fri, 06 Nov 2009 13:53:05 -0000

teastep@shorewall.net wrote:
> bgardner@iprotech.info wrote:
> > teastep@shorewall.net wrote:
> >> bgardner@iprotech.info wrote:
> >>> teastep@shorewall.net wrote:
> >>>> bgardner@iprotech.info wrote:
> >>>>> Is it possible to create rules that apply to specific
codes of
> ICMP
> >>>> types?
> >>>>> The AllowICMPs macro seems to have this type of
precision for
> ICMP
> >>>> type 3 code 4.
> >>>>> How can I write a rule that has this kind of precision
for
> >> arbitrary
> >>>> ICMP types/codes?
> >>>>
> >>>> The same way as the macro does.
> >>>>
> >>> The macro appears to use keywords:
''fragmentation-needed'' and
> ''time-
> >> exceeded''
> >>> Where can I find where these are defined?  Or, is there a list
> >> acceptable keywords?
> >>> I grepped /etc/shorewall and /usr/share/shorewall but nothing
came
> >> up.
> >>
> >> From /usr/share/shorewall/Shorewall/IPAddrs.pm, here is the list
of
> >> keywords and their corresponding codes:
> >>
> >
> > Thanks a lot for this!
> >
> > Can these keywords be used directly in /etc/shorewall/rules?  How
> about the values they represent, like this:
> >
> > ACCEPT    fw    net    icmp    12/1
>
> Yes and Yes. See
>
> 1) http://www.shorewall.net/configuration_file_basics.htm#ICMP
> 2) http://www.shorewall.net/manpages/shorewall-rules.html (look under
> DEST PORTS(S))
>

Thanks again.

I was googling all over the place yesterday, I don''t know how I missed
these.