• Welcome to Hurricane Electric's IPv6 Tunnel Broker Forums.

What IP Address Do ICMP Pings Arrive From?

Started by angelou, May 11, 2011, 11:58:19 PM

Previous topic - Next topic

angelou

Greetings,

I tend to block ICMP inbound for security purposes, but obviously this causes problems with HE.  I would like to know what IP address or range I would need to whitelist for ICMP in order to ensure your systems would be able to successfully ping me for the purpose of deciding to keep the tunnel open.

Obviously I would like to limit this range as much as possible.  I was not sure if it was perhaps just the server I was connecting to that took care of this issue, or if there were other servers involved in the verification as well.  Any and all assistance is appreciated.

cholzhauer

You only need to allow the IP of the tunnel you're connecting to.

You only need to allow it when you first setup your tunnel; there's no use for it on the HE side after that.

snarked

Actually, there is (continued HE use).  That's how the top 20 tunnel latency list per tunnel server is generated.

broquea

You should make sure to allow 66.220.2.74 to ping you so we can verify that the IPv4 address is reachable and up.

As for the Top 20 lists, those are all IPv6 pings, so make sure you aren't filtering out IPv6 ICMP which honestly you shouldn't do anyways.