IP traffic over ICMP tunneling

Re:IP traffic over ICMP tunneling by txutxu on Wednesday November 11, 2015 @11:51AM (#10547574)

OK, I see "length" extension in man iptables-extensions (Debian 8), so for example, to drop pings with a packet size greater than 85 bytes:

    # iptables -A FORWARD -p icmp --icmp-type echo-request -m length --length 86:0xffff -j DROP

Still, until someone checks the code of this tool, or a working test environment, we won't know if the rule stops this tool.

Update: as for the number of packets, there is -m limit and other recipes.

[ Parent | on HN ]

Re:IP traffic over ICMP tunneling by ryan-c on Wednesday November 11, 2015 @11:57AM (#10547603)

If you're going to do that, set the maximum length to 128 bytes. Different ping tools use different sized payloads - I know of some common ones that generate packets by default that would be blocked with that limit.

Also, instead of using the plain limit match, check out hashlimit. It can apply a rate limit on a per sender, destination, or sender+destination basis. The recent match may also be of interest.

[ Parent | on HN ]