IPFILTER_DEFAULT_BLOCK & No route to host

[Nikolay Kanchev]

You should enable ICMP protocol to your server from You are want - LAN or
outside.
ICMP protocol is used by ping utility.
When You add IPFILTER_DEFAULT_BLOCK Your firewall stop all, that is not
allowed, including ICMP packets and You can't ping server.

----- Original Message ----- 
From: "echelon" <e_chelon at yahoo.com>
To: <freebsd-stable at freebsd.org>; <freebsd-security at freebsd.org>
Sent: Tuesday, September 30, 2003 4:27 AM
Subject: IPFILTER_DEFAULT_BLOCK & No route to host


> Hi,
>
> After the option IPFILTER_DEFAULT_BLOCK is specified at kernel conf on
FreeBSD 4.8 stable (cvsup'd
> with tag RELENG_4_8), the machine cannot be ping'd by others on the same
network.
>
> In addition, the machine cannot ping itself.
>
> ping localhost (or 127.0.0.1) -> no route to host
> ping itself with its own ip address -> no route to host
>
> The freebsd box, with an external pppoe connection, is configured as a
gateway with nat.
> Interestingly, all machines on the lan can access the internet via the
freebsd box normally even
> though the freebsd box cannot be ping'd from these machines.
>
> The routing table is fine. All these problems go away if I remove the
option
> IPFILTER_DEFAULT_BLOCK from the kernel conf. I make clean before
buildworld/kernel.
>
>
> Thank you.
> e_chelon
>
>
> __________________________________
> Do you Yahoo!?
> The New Yahoo! Shopping - with improved product search
> http://shopping.yahoo.com
> _______________________________________________
> freebsd-security at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to
"freebsd-security-unsubscribe at freebsd.org"
>