iptables drop all incoming ICMP requests except from one IP

You need to run your rules in the opposite order. Iptables is sensitive to the order that commands were run. If a rule matches, it doesn't go on to check more rules, it just obeys that one. If you set the drop first, the accept rule will never get tested. By setting the specific accept with the source IP, then setting the more general policy to drop you will affect the expected behavior.

iptables -A INPUT -s x.x.x.x -p ICMP --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP

As for the hang problem you seem to be having, are you sure you entered a valid IP address? Perhaps you can prefix that command with strace iptables … to see what it's doing while it appears to hang.


Do not drop ICMP willy-nilly! Sure, some of the ICMP requests are dangerous, but the rest is absolutely required for the network to work (think "destination unreachable" and that zoo).

Tags:

Linux

Iptables