HP ProCurve NAC 800, Руководство пользователя

Страница: 466 / 591

System Administration
Supporting Network Management System
15-38
To:
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
4. Save and exit the file.
5. At the command line, enter the following:
/etc/rc.d/rc.local
Restricting the ICMP Request
If you wish to restrict the ping request to a specific interface, such as the
interface facing the protected network, then after following the procedures
above, follow the instructions in this section to add rules to the firewall chain
so that ping requests are only viable through the interface specified.
To restrict ping entries to a specific interface:
Command line
1. At the MS command line, enter the following iptables entries in this order:
iptables -A RH-Lokkit-0-50-INPUT -p icmp --icmp-type
echo-request -i ethx -j ACCEPT
iptables -A RH-Lokkit-0-50-INPUT -p icmp --icmp-type
echo-request -j DROP
Where:
ethx
is the interface that you wish to be "pingable". For example, eth0.
2. In order for these changes to persist through reboots, enter the following
command at the command line:
iptables-save > /etc/sysconfig/iptables.save