I need a quick response, urgent

General questions
1

hello

How can I “no response from host” the vyos ip address that shows traceroute?

my vyos ip x.x.x.120

i dont want see my vyos ip address on traceroute

if i closed icmp on firewall my bgp sessions are down and router network is down
note: router ip is not in bgp my router ip static routed to me

i tried this firewall commands

set interfaces ethernet eth3 firewall local name ‘management-filter’
set firewall name management-filter rule 5 action drop
set firewall name management-filter rule 5 protocol icmp

Example
image

2

I don’t work with BGP so this may not work, but if your connection goes down when enabling icmp drop, why add a rule before drop to allow icmp from BGP neighbors?

3

bgp just a sample

network is totally down i dropped only icmp packets
my router ip is not in bgp and i cant access my router

its not important your work with bgp or not if you are hide router ip on traceroute packets can you help me on this ?

4

Is eth3 your wan uplink or lan downlink?

If it’s your wan uplink and it goes down when you drop icmp, it sounds like your isp uses ping to make sure you’re online. I would check with them.

5

Possible similar setup: ICMP From VyOS to WAN - #6 by jfranco

6

eth3 is my wan

thank you i will try

7

IIRC firewall rules have a default action of ‘drop’ unless otherwise specified. So if your firewall policy only has one rule which is dropping icmp it will also by default drop all other traffic. You need to create another rule to allow desired traffic or add a default action to the firewall policy, e.g.

set firewall name management-filter default-action accept

8

hmm okey if i added default-action accept and dropped icmp i think my problem resolved

thank you

i will try 1-2 days after

9

Obviously it goes without saying you need to determine if that is appropriate for your environment. If eth3 is an internet connection and the firewall policy is applied local then that is dealing with traffic to your vyos router itself. Denying ICMP but allowing everything else to the vyos router may or may not be appropriate and is up to you to decide. If it’s not then you should do as firedrow suggested and allow just your BGP peer and whatever else you may need.