5

I'm trying to figure out the IPTABLES rule in order to rate-limit ICMP (ping) traffic to 5 packets per second. Here is the command I've tried so far but with no success:

iptables -A OUTPUT -p icmp -m limit --limit 5/second  -j ACCEPT

Does anyone have any ideas how to write this?

Improve this question
3
  • Are you sure you do not mean -A INPUT? Why would you want to rate-limit your own pings?
    – MariusMatutiae
    Nov 27, 2015 at 8:06
  • @MariusMatutiae: Perhaps they're trying to limit replies instead? The end result is mostly the same. (That said, Linux already rate-limits ICMP traffic in a smarter way – based on message type.)
    – u1686_grawity
    Nov 27, 2015 at 8:13
  • This would also match all icmp traffic, not just pings, and if you are trying to reduce device impact by limiting, filtering on OUTPUT would not stop the incoming request, the processing of it, or the generation of the reply packet, just it's delivery.
    – Radhil
    Dec 2, 2015 at 1:09

1 Answer 1

Reset to default
8

This used to be rather standard lore a few years back, when smurf attacks were common. I have not seen one in quite a few years now, but at any rate the common defense was to use these three rules:

 iptables -A INPUT -p icmp -m icmp --icmp-type address-mask-request -j DROP
 iptables -A INPUT -p icmp -m icmp --icmp-type timestamp-request -j DROP
 iptables -A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT

The first two rules are necessary for the protection; if this is not your worry, then just dump them, and use the other one. Under most normal circumstances, you can be sterner than you originally envisaged, 1 ping per second is plenty for legitimate uses.

As you can see, stating that the protocol to watch is icmp is not enough: you also have to load the icmp module, -m icmp.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .