Firewall Filtering ICMP Packet to many destination

RouterOS General
1

Hello everyone

This is a case that I face right now for my study. According to this topology all network had been route using OSPF routing.
Case1.jpg
The case is make R5 can’t PING to R1,R2,R3,and R4 but R1,R2,R3, and R4 can PING to R5. The configuration is made on R3 and R4.

I have tried block it with firewall filter, like these

R3

ip firewall filter add chain=forward src-address=40.40.40.2 dst-address=20.20.20.0/28 protocol=icmp icmp-option=8:0 action=accept
ip firewall filter add chain=forward src-address=40.40.40.2 dst-address=20.20.20.0/28 protocol=icmp icmp-option=0:0 action=accept
ip firewall filter add chain=forward src-address=40.40.40.2 dst-address=10.10.10.0/28 protocol=icmp icmp-option=8:0 action=accept
ip firewall filter add chain=forward src-address=40.40.40.2 dst-address=10.10.10.0/28 protocol=icmp icmp-option=0:0 action=accept
ip firewall filter add chain=input protocol=icmp action=drop

The same on the R4, I just change the src-address with 50.50.50.2. But it isn’t work the R5 sure can’t PING to R1 and R2, but still can to R3 and R4. If I add a chain input=drop the result is R5 lost connection route to R1, and R2. Is there any method that i can use on this?

Thank you, and sorry for my bad english. Hope you can understand it.

2

Chain input handles packets for the router itself, so this rule doesn’t match on packets being forwarded from one interface to another.

And in chain forward, there are currently only accept rules, but no drop one; since accept is the default handling (for packets not matching any of the rules in their respective chain), packets not accepted by one of your existing rules are accepted anyway, by default.

If you just change the chain of your last rule from input to forward, you’ll block more than the submission requires. ICMP is used for much more purposes than ping, and blocking it completely causes various kinds of problems.

So it is enough to allow ping requests (ICMP “echo” packet, 8:0) to pass if they come in via e2, and drop them otherwise.