1

I'm under firewall, I can ping to some hosts but not to other hosts

my IP addresss 172.19.7.111 mask 255.255.240.0

I can ping to host 172.19.2.111 (that I discovered with Angry IP Scanner) but not to 172.19.2.167 which is my rapsberry.

I checked both host IP address with ifconfig. both have mask 255.255.240.0

hosts not reached are not detected by Angry IP Scanner.

Scanning network for open ports with nmap command for host 172.19.2.167 (wlan0)

nmap -v -sT 172.19.4.47 -Pn

 Completed Connect Scan at 20:28, 14.39s elapsed (1000 total ports)
    Nmap scan report for 172.19.4.167
    Host is up (0.11s latency).
    All 1000 scanned ports on 172.19.4.167 are filtered

I can ping this host 1"72.19.4.167" via eth0 (192.168.0.0 /24 network )

Scanning with eth0 network (1952.168.0.0/24) (same host)

Initiating Connect Scan at 21:20 Scanning 192.168.0.2 [1000 ports]

Discovered open port 22/tcp on 192.168.0.2
Completed Connect Scan at 21:20, 0.14s elapsed (1000 total ports)
Nmap scan report for 192.168.0.2
Host is up (0.011s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE
22/tcp open  ssh
MAC Address: B8:27:EB:D5:44:B8 (Raspberry Pi Foundation)

gateway scan (172.19.0.5)

Starting Nmap 6.40 ( http://nmap.org ) at 2014-04-28 21:12 CEST
Initiating ARP Ping Scan at 21:12
Scanning 172.19.0.5 [1 port]
Completed ARP Ping Scan at 21:12, 0.02s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 21:12
Completed Parallel DNS resolution of 1 host. at 21:12, 0.01s elapsed
Initiating Connect Scan at 21:12
Scanning pftw01.crous.lan (172.19.0.5) [1000 ports]
Discovered open port 53/tcp on 172.19.0.5
Discovered open port 8080/tcp on 172.19.0.5
Discovered open port 22/tcp on 172.19.0.5
Discovered open port 8000/tcp on 172.19.0.5
Discovered open port 8001/tcp on 172.19.0.5
Completed Connect Scan at 21:12, 4.41s elapsed (1000 total ports)
Nmap scan report for pftw01.crous.lan (172.19.0.5)
Host is up (0.0045s latency).
Not shown: 995 filtered ports
PORT     STATE SERVICE
22/tcp   open  ssh
53/tcp   open  domain
8000/tcp open  http-alt
8001/tcp open  vcom-tunnel
8080/tcp open  http-proxy
MAC Address: 00:0C:29:D4:41:EB (VMware)

any explanations???

  • Please give us more details about your network, the source and destination devices. What kind of hardware is it? How the devices are connected? Where are the firewall connected and so on ... – UsersUser Apr 28 '14 at 10:51
  • I have my laptop (172.19.7.110), raspberry (172.19.4.167), I can ping and ssh rapsberry via eth0 (192.168.0.0/24) but not via wlan0 (172.19.X.X/255.255.240.0), but I discovered other IP address with Angry IP Scanner (172.19.2.111) that I can ping – Makhlouf GHARBI Apr 28 '14 at 19:17
0

172.19.7.111/20 & 172.19.2.111/20 are on the same subnet. 172.192.2.167 is definitely on a different subnet. I think you need to add rules to forward packets between the two subnets.

  • sorry I mean I can ping to host 172.19.2.111 but not to 172.19.2.167 – Makhlouf GHARBI Apr 27 '14 at 21:56
  • 1
    Does the destination machine have any firewall rule to ignore ICMP Echo Requests? If you know that a firewall is in place, you might want to modify the rules to work for you. – Ghassan Apr 27 '14 at 22:04
  • if the firewall ignore ICMP, how can I ping successfully to 172.19.2.111 ???, and why Angry Ip Scanner cant detect the other host who has 172.19.2.167 IP ?? – Makhlouf GHARBI Apr 27 '14 at 22:07
  • for IP address, 172.19.2.111 I detected it by Angry Ip Scanner, im not sure that is ordinary host, there is other IP address like that in this network where I can ping – Makhlouf GHARBI Apr 27 '14 at 22:12
  • 1
    I did not mean a firewall between the two machines. I meant the firewall on the machine itself. Something like a firewall software on the remote machine itself, such as iptables on Linux. The successful ping could be to a machine that does not ignore ICMP echo requests. – Ghassan Apr 27 '14 at 22:20
0

You could get an answer from the host that will be inside a private network 172.19.2.111 but not from the public internet 172.192.2.167 - Please look at list of private networks - only 172.16.0.1 to 172.31.255.254 are private networks - every ip address outside these range will be routed into internet.

  • sorry I mean I can ping to host 172.19.2.111 but not to 172.19.2.167, – Makhlouf GHARBI Apr 27 '14 at 21:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.