Page MenuHomePhabricator

firewall all-ping setting is confusing
Closed, ResolvedPublicBUG

Description

My understanding of this setting is that it would generate rules for the firewall rule sets that allow or block pings. This doesn't seem to be the case. You still need to open up the firewall manually for the ICMP echo requests. Pinging works then. However, when you put the all-ping to disabled, ping requests stop working. So probably this is a sysctl setting. On IRC, dmbaturin suggested moving the setting perhaps to system options ip.

Details

Difficulty level
Easy (less than an hour)
Version
1.1.7
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Perfectly compatible

Event Timeline

syncer added a subscriber: VyOS 1.2 Crux.
pasik added a subscriber: pasik.Oct 1 2018, 9:54 AM
dmbaturin removed a subscriber: VyOS 1.2 Crux.
syncer changed the subtype of this task from "Task" to "Bug".Oct 20 2018, 4:51 AM
s.lorente added a subscriber: s.lorente.

According to my findings, firewall all-pingaffects only to LOCAL. It does not affect to IN or OUT.

When firewall all-ping enable is set, VyOS will answer every ICMP echo request addressed to itself, but that will only happen if no other rule is applied droping/rejecting local echo requests. In case of conflict, VyOS will not answer ICMP echo requests.

When firewall all-ping disable is set, VyOS will answer no ICMP echo request addressed to itself at all, no matter where they come from or whether more specific rules are being applied to accept them.

So the command affects only to LOCAL and it always behaves in the most restrictive way.

zsdc added a subscriber: zsdc.Mon, Sep 16, 11:29 AM

@s.lorente, could you please add details about this option to the https://github.com/vyos/vyos-documentation?

s.lorente closed this task as Resolved.Tue, Sep 17, 4:03 PM
s.lorente set Why the issue appeared? to Will be filled on close.
s.lorente set Is it a breaking change? to Perfectly compatible.