i want to drop icmp accepte for ip 192.168.10.10
/ip firewall filter
add action=drop chain=forward comment=" ping" disabled=yes dst-address=\
!192.168.10.10 protocol=icmp
Re: rule not for one ip
Generally speaking that's the right idea, but you have to make sure that the packet going the other way isn't dropped, either.
Is 192.168.10.10 supposed to be the only IP able to initiate pings to other IPs, or is it supposed to be the only IP address pingable by other IPs?
Is 192.168.10.10 supposed to be the only IP able to initiate pings to other IPs, or is it supposed to be the only IP address pingable by other IPs?
Re: rule not for one ip
yes,the 192.168.10.10 supposed to be the only IP able to initiate pings to other IPs
but it dont work
but it dont work
Re: rule not for one ip
Without state:
With state:
You can write a rule like you tried to, but it's often not a good idea. Generally with firewall rules it is always better to explicitly accept the traffic you want to flow and then to broadly drop everything else than to selectively drop traffic. The more complicate the ruleset gets the easier it is to forget to drop something, but it's usually fairly easy to permit what you need and then not have to worry about everything else.
Code: Select all
/ip firewall filter
add chain=forward protocol=icmp src-address=192.168.10.10 action=accept
add chain=forward protocol=icmp dst-address=192.168.10.10 action=accept
add chain=forward protocol=icmp action=dropCode: Select all
/ip firewall filter
add chain=forward connection-state=established action=accept
add chain=forward connection-state=related action=accept
add chain=forward protocol=icmp src-address=192.168.10.10 action=accept
add chain=forward protocol=icmp action=drop
Re: rule not for one ip
And just for completion's sake, the problem with your original rule:
is that when 192.168.10.10 sends an echo request to 1.1.1.1, the destination address of the packet is 1.1.1.1, which matches !192.168.10.10 so the echo request itself gets dropped. The target never sees a request so it never sends an echo reply.
Code: Select all
/ip firewall filter
add action=drop chain=forward comment="ping" dst-address=!192.168.10.10 protocol=icmpWho is online
Users browsing this forum: No registered users and 35 guests