Ping to pppoe server fails, while reverse is working

Question

I have created a Linux PPPoE server on CentOS release 5.4 (Final) x86_64 machine (Linux 2.6.18-164.el5 #1 SMP). I have also established the PPPoE connection successfully. However, ping to server from client using ppp interface fails, while server could ping client successfully.

Server ppp IP: 10.0.0.1 Client ppp IP: 10.67.15.111

PPP Interface at server:

ppp0      Link encap:Point-to-Point Protocol
          inet addr:10.0.0.1  P-t-P:10.67.15.111  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:513 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:42304 (41.3 KiB)  TX bytes:130 (130.0 b)

Tcpdump at server prints outgoing ping request, and incoming responses from client.

# tcpdump -i ppp0 -X
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ppp0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
21:37:12.218177 IP 10.0.0.1 > 10.67.15.111: ICMP echo request, id
30999, seq 1, length 64
        0x0000:  4500 0054 0000 4000 4001 16f7 0a00 0001  E..T..@.@.......
        0x0010:  0a43 0f6f 0800 2d54 7917 0001 b019 b352  .C.o..-Ty......R
        0x0020:  0000 0000 2c54 0300 0000 0000 1011 1213  ....,T..........
        0x0030:  1415 1617 1819 1a1b 1c1d 1e1f 2021 2223  .............!"#
        0x0040:  2425 2627 2829 2a2b 2c2d 2e2f 3031 3233  $%&'()*+,-./0123
21:37:12.222904 IP 10.67.15.111 > 10.0.0.1: ICMP echo reply, id 30999,
seq 1, length 64
        0x0000:  4500 0054 af93 0000 4001 a763 0a43 0f6f  E..T....@..c.C.o
        0x0010:  0a00 0001 0000 3554 7917 0001 b019 b352  ......5Ty......R
        0x0020:  0000 0000 2c54 0300 0000 0000 1011 1213  ....,T..........
        0x0030:  1415 1617 1819 1a1b 1c1d 1e1f 2021 2223  .............!"#
        0x0040:  2425 2627 2829 2a2b 2c2d 2e2f 3031 3233  $%&'()*+,-./0123

Tcpdump at server prints incoming ping request, but no responses were sent

21:38:06.942359 IP 10.67.15.111 > 10.0.0.1: ICMP echo request, id
13435, seq 2, length 64
        0x0000:  4500 0054 0000 4000 4001 16f7 0a43 0f6f  E..T..@.@....C.o
        0x0010:  0a00 0001 0800 4c41 347b 0002 a04d d6f3  ......LA4{...M..
        0x0020:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0030:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0040:  0000 0000 0000 0000 0000 0000 0000 0000  ................
21:38:07.946344 IP 10.67.15.111 > 10.0.0.1: ICMP echo request, id
13435, seq 3, length 64
        0x0000:  4500 0054 0000 4000 4001 16f7 0a43 0f6f  E..T..@.@....C.o
        0x0010:  0a00 0001 0800 f1e1 347b 0003 a05d 3142  ........4{...]1B
        0x0020:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0030:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0040:  0000 0000 0000 0000 0000 0000 0000 0000  ................
21:38:08.958344 IP 10.67.15.111 > 10.0.0.1: ICMP echo request, id
13435, seq 4, length 64
        0x0000:  4500 0054 0000 4000 4001 16f7 0a43 0f6f  E..T..@.@....C.o
        0x0010:  0a00 0001 0800 881b 347b 0004 a06c 9af8  ........4{...l..
        0x0020:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0030:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0040:  0000 0000 0000 0000 0000 0000 0000 0000  ................

I have configured only PPPD and PPPoE server related config. Could some one help, i have not enabled any firewall options.

After checking both the links:

http://www.trickylinux.net/disable-ping-response-linux.html

cat /proc/sys/net/ipv4/icmp_echo_ignore_all
0

https://unix.stackexchange.com/questions/44596/what-prevents-a-machine-from-responding-to-pings

# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        targeted
# 
# 
# setenforce 0
# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        targeted
# system-config-securitylevel-tui
# 
# 
# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          permissive
Policy version:                 21
Policy from config file:        targeted
# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          permissive
Policy version:                 21
Policy from config file:        targeted
# system-config-securitylevel-tui
# 
# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          disabled
Policy version:                 21
Policy from config file:        targeted
# vi system-config-securitylevel
# system-config-securitylevel
# 
# 
# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          disabled
Policy version:                 21
Policy from config file:        targeted

Also find my current firewall settings as per comments of MadHatter.

iptables -L -n -v
Chain INPUT (policy ACCEPT 16472 packets, 12M bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       tcp  --  ppp+   *       0.0.0.0/0            0.0.0.0/0           tcp dpts:0:1023 
    0     0 DROP       udp  --  ppp+   *       0.0.0.0/0            0.0.0.0/0           udp dpts:0:1023 
    0     0 DROP       tcp  --  ppp+   *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x02 
 4186  352K DROP       icmp --  ppp+   *       0.0.0.0/0            0.0.0.0/0           icmp type 8 

Chain FORWARD (policy DROP 90 packets, 5400 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 17307 packets, 2685K bytes)
 pkts bytes target     prot opt in     out     source               destination

Same cmd after some, i notice lot of drops.

 iptables -L -n -v
Chain INPUT (policy ACCEPT 18176 packets, 13M bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       tcp  --  ppp+   *       0.0.0.0/0            0.0.0.0/0           tcp dpts:0:1023 
    0     0 DROP       udp  --  ppp+   *       0.0.0.0/0            0.0.0.0/0           udp dpts:0:1023 
    0     0 DROP       tcp  --  ppp+   *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x02 
 4934  414K DROP       icmp --  ppp+   *       0.0.0.0/0            0.0.0.0/0           icmp type 8 

Chain FORWARD (policy DROP 90 packets, 5400 bytes)
 pkts bytes target     prot opt in     out     source               destination         

    Chain OUTPUT (policy ACCEPT 19179 packets, 3241K bytes)
     pkts bytes target     prot opt in     out     source               destination

Does it require any explicit firewall rule to respond to incoming ping request.

Thanks in advance. -Murugan

You say you have enabled no firewall options, but pasting the output of `iptables -L -n -v` on the server into your question would be more definitive. — MadHatter, Dec 19 '13 at 11:18

score 0 · Accepted Answer · answered Dec 19 '13 at 11:41

0

You may say that you "have not enabled any firewall options", but right there, the fourth rule in your INPUT chain, is a line that drops all (inbound) ICMP type 8 (echo-request) on all ppp interfaces. It's even got a nice, large, growing packet count, to let you know it's doing its job.

Try iptables -D INPUT 4 on the server.

And in answer to your closing question above: no. No explicit firewall rule is required to respond to PING requests. You are, however, required to stop explicitly dropping them on the floor.

answered Dec 19 '13 at 11:41

MadHatter

78,442
20
178
229

It works now. # iptables -D INPUT 4 # iptables -L -n -v 0 0 DROP tcp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 – UserM Dec 19 '13 at 11:46
You're wulcome. – MadHatter Dec 19 '13 at 11:47

Ping to pppoe server fails, while reverse is working

1 Answers1