RV180 - How can I unblock WAN ICMP traffic from a specific address?

[Media3Ltd]

My ISP is unable to ping my router (see below).  Short of enableing "Respond to Ping on WAN", nothing seems to work.

"Dear Cogent Customer,

Cogent is unable to proactively test the status of your circuit because it appears that there is a universal ICMP block in place. Unfortunately, if Cogent is unable to monitor the IP specified it is impossible for us to honor the Guarantees and Service Credits provided in any Service Level Agreement, Customer Service Agreement or other type of performance level agreement that you currently have with Cogent Communications.  More importantly, it makes it impossible for Cogent Support to proactively troubleshoot problems because we have no visibility.

This can be resolved by blocking all ICMP traffic except from the Cogent monitoring IP blocks of 66.28.3.0/24, 66.250.250.0/24 and 130.117.254.0/24 (EU only).  The IP ranges for IPv6 monitoring are 2001:550:1:300::/56 for North America and 2001:550:1:300::/56 for the European Union.  Failing that, we will have to turn off the monitoring of your circuit because it will continue to give false alarms.  You would need to call Cogent Technical Support at 877-7COGENT, option 2, reference ticket number HD5537786 and request that network status monitoring be turned back on if that happens.  We would test the new configuration to ensure we can monitor the IP and then gladly return your circuit to monitored status."

Thank you,

Damon

[aunrein]

Hello Damon,

I believe that you can achieve your desired result by enabling "Respond to Ping on WAN" and creating an ACL rule that blocks all ICMP traffic from the Internet except for the traffic from a specified range of addresses. You can configure ACLs by navigating to Firewall > Access Rules in the GUI.

Let me know if this works.

Thanks,

Alex

[Media3Ltd]

Hi Alexander,

Yes, this makes total sense and is exactly what I want to achieve, but just don't see any way to create an IP exception under the access rule options of a RV180.  Am I missing something or is it located under some other tab?

Thanks,

Damon

[aunrein]

Hello Damon,

Sorry for the late reply.

Here is what I think you need to do. First, go to Firewall > Access Rules in GUI. Click Add Rule. Configure the rule to allows ICMP traffic from the WAN to LAN for a specified source IP address or IP address range. The source IP needs to be your ISP's address that they will be using to ping you. Save that Access Rule. Then, create a second Access Rule that blocks all ICMP traffic from the WAN to LAN regardless of address. I believe this configuration should accomplish what you want.

Let me know if this works.

Thanks,

Alex

[Dilyan Dimov]

Firewall > Attack Prevention - Select "Respond to Ping on WAN (Internet)" and Save it!