This used to be rather standard lore a few years back, when smurf
attacks were common. I have not seen one in quite a few years now, but at any rate the common defense was to use these three rules:
iptables -A INPUT -p icmp -m icmp --icmp-type address-mask-request -j DROP
iptables -A INPUT -p icmp -m icmp --icmp-type timestamp-request -j DROP
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
The first two rules are necessary for the protection; if this is not your worry, then just dump them, and use the other one. Under most normal circumstances, you can be sterner than you originally envisaged, 1 ping per second is plenty for legitimate uses.
As you can see, stating that the protocol to watch is icmp
is not enough: you also have to load the icmp
module, -m icmp
.
-A INPUT
? Why would you want to rate-limit your own pings?