How to Block ICMP Echo Reply from Gateway IP

Answered Question

Hi,

I have following design, please see attached diagram.

I applied access-list in R1 interface facing GGSN. I want to block icmp and ip between GGSN pulbic IP pool and the private IP in the internal network..between R1 & R2.

But i got problem when trace route from client (ip pool), the 192.168.196.65 gateway is always show up in trace route.

I want to hide the private from the client user.

How to block icmp echo reply from this 192.168.196.65 interface ?

interface Vlan1619

description Gi-diginet-A

ip vrf forwarding V502:Gi-diginet

ip address 192.168.196.65 255.255.255.248

ip access-group block-apn2private_hwdiginet in

ip access-group block-private2apn_hwdiginet out

no ip redirects

no ip unreachables

no ip proxy-arp

h ip access-lists

Extended IP access list block-apn2private_hwdiginet

10 deny ip 115.164.0.0 0.0.255.255 192.168.0.0 0.0.255.255 (6 estimate matches)

20 deny ip 115.164.0.0 0.0.255.255 172.16.0.0 0.0.31.255

30 deny ip 115.164.0.0 0.0.255.255 10.0.0.0 0.255.255.255 (23 estimate matches)

40 deny icmp 115.164.0.0 0.0.255.255 192.168.0.0 0.0.255.255

50 deny icmp 115.164.0.0 0.0.255.255 172.16.0.0 0.0.31.255

60 deny icmp 115.164.0.0 0.0.255.255 10.0.0.0 0.255.255.255

70 permit ip any any (23299 estimate matches)

Extended IP access list block-private2apn_hwdiginet

10 deny ip 192.168.0.0 0.0.255.255 115.164.0.0 0.0.255.255

20 deny ip 172.16.0.0 0.0.31.255 115.164.0.0 0.0.255.255

30 deny ip 10.0.0.0 0.255.255.255 115.164.0.0 0.0.255.255

40 deny icmp 192.168.0.0 0.0.255.255 115.164.0.0 0.0.255.255

50 deny icmp 172.16.0.0 0.0.31.255 115.164.0.0 0.0.255.255

60 deny icmp 10.0.0.0 0.255.255.255 115.164.0.0 0.0.255.255

70 permit ip any any (64114 estimate matches)

I have this problem too.
0 votes
Correct Answer by Yudong Wu about 7 years 9 months ago

Not sure what platform you are using but it should be something like this.

access-list 100 permit icmp any [client-IP-range] echo-r

route-map LOCAL permit 10

match ip address 100

set interface null0

ip local policy route-map LOCAL

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Yudong Wu Thu, 04/09/2009 - 05:17

If client does a trace route to a public IP, your inbound ACL won't block it. If I remember correctly, outbound ACL won't apply to the packet generated locally.

You can use a local policy map to drop the icmp reply to the client.

Correct Answer
Yudong Wu Thu, 04/09/2009 - 08:30

Not sure what platform you are using but it should be something like this.

access-list 100 permit icmp any [client-IP-range] echo-r

route-map LOCAL permit 10

match ip address 100

set interface null0

ip local policy route-map LOCAL

Actions

This Discussion