ICMP block via firewall-config

Jiri Popelka jpopelka at redhat.com
Fri Aug 30 14:52:23 UTC 2013


On 08/27/2013 08:30 PM, Mark Sobell wrote:
> Now the thing I am wondering about is
>
> Permanent Configuration, ICMP Types tab, Destination tab, highlight
> echo-request, tick IPv4 or IPv6.
>
> I assume putting a tick next to IPv4 or IPv6 must limit which
> destination the firewall blocks.

Correct,
- tick IPv4 means firewall will block this ICMP Type for IPv4 (ICMPv4)
- tick IPv6 means firewall will block this ICMP Type for IPv6 (ICMPv6)
- having *both* ticket means block both ICMPv4 and ICMPv6
- having *none* ticket *also* means block both ICMPv4 and ICMPv6  <- 
this has been very confusing in my point of view. Hopefully this commit 
(see the comment there) makes the logic more understandable:
https://git.fedorahosted.org/cgit/firewalld.git/commit/?id=4b1928ec707e7468340ca1ea48db1d3e814dbe95

I also changed the label from
"If you specify destination addresses, the ICMP Type entry will be 
limited to the destination."
to
"Specify whether this ICMP Type is available for IPv4 and/or IPv6."

If you think of something better, let me know.
Thanks

--
Jiri



More information about the firewalld-users mailing list