How do I make ping and traceroute work?
This question isn’t as simple as it sounds. It takes an understanding of filtering, ICMP, UDP, ping, and traceroute. Here are some of the basics to get you started. Remember that if you are keeping state on all outgoing ICMP, then outgoing pings will automatically work. Ping uses ICMP. Specifically it entails an ICMP type 8 code 0 (herein refered to as ICMP 8/0) packet (called “echo request”) being sent to the target, and an ICMP 0/0 packet (called “echo reply”) being sent back to the original host. To allow pings out one might do: pass out quick proto icmp from any to any icmp-type 8 code 0 keep state or if you didn’t want to use keep state you could do: pass out quick proto icmp from any to any icmp-type 8 code 0 pass in quick proto icmp from any to any icmp-type 0 code 0 Traceroute requires ICMP 11/0 and 3/3 (TTL expired and Port unreachable respectively). You will let to need to let these in to your network to allow outgoing traceroutes. Additionally, UNIX traceroute requires UDP p
