Icmp,tcp,traceroute,ping,iptables

There is a monitoring host in Dongguan to Beijing, the problem of BGP; alarm SMS sent frantically; find Dongguan IDC and Beijing BGP service Provider assistant investigation;

There is a strange problem; Beijing to Dongguan Trcaceroute have routing information

Dongguan 143 to Beijing there is no routing information; but, Dongguan 151 to Beijing there is routing information;

Check the iptables configuration for 143 and 151 segments, and find subtle differences:

143:

# Generated by Iptables-save v1.3.5 on Fri Dec 19 17:00:58 2014
*filter
: INPUT ACCEPT [0:0]
: FORWARD ACCEPT [0:0]
: OUTPUT ACCEPT [3,815,024,465:25,962,152,950,339]

......

-A input-m conntrack--ctstate established-j ACCEPT
-A input-i lo-j ACCEPT
-A input-j DROP
-A output-m conntrack--ctstate new-j ACCEPT
COMMIT
# completed on Fri Dec 19 17:00:58 2014

151:

# Generated by Iptables-save v1.4.7 on Fri Dec 19 17:01:18 2014
*filter
: INPUT ACCEPT [158,253,008:8,885,848,717]
: FORWARD ACCEPT [0:0]
: OUTPUT ACCEPT [108,990,300,717:428,153,347,609,533]

.................

-A input-m conntrack--ctstate established-j ACCEPT
-A input-i lo-j ACCEPT
-A input-p tcp-m tcp--dport 22-j DROP
-A output-m conntrack--ctstate new-j ACCEPT
COMMIT
# completed on Fri Dec 19 17:01:18 2014

It has been noted that:

-A input-j DROP--------------------------------------->ping is output;traceroute when each routing node returns the packet;

The rule-a output-m conntrack--ctstate new-j Accept is the TCP protocol by default, whereas the Ping/traceroute uses the ICMP protocol;

-A input-p tcp-m tcp--dport 22-j drop-----------------> This just DROP the 22 port, in addition to the others are released;

====

Optimize 143 segment configurations such as:

#-a input-p icmp-j ACCEPT------------------------------------------> Add this Rule
-A input-m conntrack--ctstate established-j ACCEPT
-A input-i lo-j ACCEPT
-A input-j DROP
#-a input-p tcp-m TCP--dport 22-j DROP
-A output-m conntrack--ctstate new-j ACCEPT
COMMIT
# completed on Fri Dec 19 17:05:26 2014

Icmp,tcp,traceroute,ping,iptables