Hi Brent,
Brent Clark schrieb:
> here is my OUTPUT
>
> $IPT -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> $IPT -t filter -A OUTPUT -m state --state INVALID -j LOG --log-prefix
> "INVALID output: " --log-tcp-options --log-ip-options
> $IPT -t filter -A OUTPUT -m state --state INVALID -j DROP
> $IPT -t filter -A OUTPUT -m state --state NEW -j ACCEPT
> $IPT -t filter -A OUTPUT -j LOG --log-prefix "[OUTPUT DROP]: "
> --log-tcp-options --log-ip-options
> $IPT -t filter -A OUTPUT -j DROP
>
> and for my lo
>
> $IPT -A INPUT -i lo -j ACCEPT
> $IPT -A OUTPUT -o lo -j ACCEPT
Looking closer to your rules, I see these possibilities:
1.) For some reasons echo-request are considered INVALID. This should
show up in your logs.
2.) You ping 217.199.186.255 :)
3.) Your client doesn't find fw
4.) /proc/sys/net/ipv4/icmp_echo_ignore_all is set to 1
echo-replies are in state ESTABLISHED, so there is no problem with your
OUTPUT chain. I don't know the real reason, but I have a feeling, that
4.) is the best bet.
HTH and have nice time,
Joerg
