LAB 24 ‐ Allow ICMP in Security List for Instances within Same Subnet - gautam-amitesh/OCI GitHub Wiki

I have two instances test-server-01 and bastion_server_01 in same public subnet 10.0.0.0/24 now we will test ping command with different security list settings.

Navigation

  1. Create Security List

    Navigation menu > Networking > Virtual cloud networks > VCN (hub-vcn) > Security

  2. Add Security List

    Navigation menu > Networking > Virtual cloud networks > VCN (hub-vcn) > Subnets > public subnet (public subnet-hub-vcn) > Security >

Default (Stateful Egress Only)

When we create VCN and Subnet by default OCI provides a security list which helps us to login remotely via SSH but don't allow ICMP Type 8 and Type 0 due to which when we will ping it will not work.

  1. First login to both instances and get the private IP of both instances which we will use for connection

    hostname -i

  2. Now run the ping command on bastion_server_01 it successfully sent packet to test-server-01 due to active egress rule for all, the packet arrives at test-server-01 and its ingress rule drops the packet and the ping fails.

  3. Now run the ping command on test-server-01 you will see that now it works. Actually the ping didn't really worked but we have successfully exploited the firewall, due to active connection tracking when we run ping on test-server-01 it sent packet to bastion_server_01 and expecting return traffic and then it receives the packet sent previously by bastion_server_01 due to which we see that its working.

Enable Stateless in default Egress Rules for ICMP

When we enable stateless in default egress rules then we will see that even if we run ping in both terminal we will not see ping working.

  1. To enable Stateless click on actions menu of particular egress rule and click edit then enable Stateless and click Save changes

  2. Now lets test ping again first run in bastion_server_01 it fails

  3. Now try ping in test-server-01 which also fails because we fixed the loophole by enabling stateless

Enable Stateless Ingress & Stateless Egress Rules for ICMP

  1. First lets remove all ingress and egress rules associated with ICMP to make the interface clean but don't touch the default TCP ingress rule

  2. Now first add the ingress rule, Enable Stateless, provide public subnet CIDR in Source CIDR, select ICMP, provide relevant Description, and click Add Ingress Rules

  3. Now lets add the egress rule, Enable Stateless, provide public subnet CIDR in Destination CIDR, select ICMP, provide relevant Description, and click Add Egress Rules

  4. Now lets test ping again first run in bastion_server_01 it works

  5. Now try ping in test-server-01 which also works

Enable Stateful Ingress & Stateful Egress Rules for ICMP

  1. We just need to edit both rules one by one to disable Stateless

  2. Now lets test ping again first run in bastion_server_01 it works

  3. Now try ping in test-server-01 which also works

Stateful Ingress Only

  1. We need to delete Egress rules for ICMP and as we already have Stateful Ingress for ICMP we don't need to do anything else

  2. Now lets test ping again first run in bastion_server_01 it fails

  3. Now try ping in test-server-01 which also fails

Stateless Ingress Only

  1. We need to enable Stateless in Ingress Rules for ICMP

  2. Now lets test ping again first run in bastion_server_01 it fails

  3. Now try ping in test-server-01 which also fails