2

I am configuring a firewall hardware, which is connected between my laptop and lab LAN (lab LAN is also connected to other computers as well as Internet). My objective is to allow the ping between my computer & another computer in the lab. Then test deny the ping function.

To ping successfully, I must allow all necessary protocols that related to "ping" by setting firewall configuration GUI. I have tried to allow several protocols together that related to ping, such as ARP, ICMP. However, "ping" is unsuccessful. I think the problem is that some protocols that support "ping" are not listed and allowed in the configuration. Is it correct? Then what protocols I need to add as well?

Improve this question

4 Answers 4

Reset to default
2

You have to allow ICPM - Echo and ICMP - Reply. For ping, thats usually all you need, arp should not be blocked by a firewall. At least, not by default.

If your ping sticks to being unsuccessful, please keep in mind that there are still some other potential issues (L2/L3 connectivity like subnetting or routing, the host you ping may have a local firewall, and so on...)

Improve this answer
5
  • After i reset the firewall hardware (no firewall rule applied), my computer can ping the target computer successfully. Hence, I guess the issue should be short of allowing certain protocol in the configuration.
    – TJCLK
    Jan 21, 2016 at 9:32
  • I have tested allowing multiple protocols at the same time: ARP, ICMP (ICMP ping only, ICMP redirect - this product has 3 categories of ICMP), TCP, HTTP, HTTPS. But still cannot ping.
    – TJCLK
    Jan 21, 2016 at 9:34
  • Did you allow the ICMP - Traffic from your computer to the target and also back from target to your computer? Sometimes you have to explicitly define incoming and outgoing rules...
    – Sebastian
    Jan 21, 2016 at 10:00
  • Yes, i defined bi-direction for allowed protocols
    – TJCLK
    Jan 22, 2016 at 6:10
  • See answer from @switch: Sometimes you also need TCP/UDP
    – Sebastian
    Jan 22, 2016 at 8:27
1

well,

at least you need to know about ICMP-echo (leaving the PING source and walking firewall in one direction) and ICMP-echo-reply that has a different type and traverse firewall in opposite direction.

moreover : "modern" PING can and often use both UDP and (fewer) TCP instead of ICMP, so that the shortest way to get rid of the matter is looking at deny-logs and determine what kind of rules you need to implement.

obviously that way is "smart" just in case you are making tests and is not for a production enviroment.

anyway be careful in opening ALL types of ICMP, at least some can be "dangerous" (let's say ICMP redirect)

Improve this answer
1

you're thinking about errors at your side, but often the matter is elsewhere except under your control.

just to know what is happening pick up traffic at dump-level (read "capture" in cisco terms or "tcpdump" in unix) and look : if ICMP-echo-req is leaving your firewall in the interface nearest to destination and no ICMP-echo-reply is coming back (at same interface) : the matter is not at your device.

moreover : ARP must not walk the firewall, it's a nonsense except for very unusual cases.

Improve this answer
0

Check the firewall logs. If it is blocking pings, it will tell you so.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.