Pinging from WAN and LAN

[gjf]

Hi All!

I am using Asus RT-AC68U with latest Merlin frimware. I have found a strange issue today.

According to Firewall General - Respond Ping Request from WAN is disabled. And it works OK - when I try to ping myself (xxx.asuscomm.com) from the world it fails.

But when I try to ping myself from internal network using "ping xxx.asuscomm.com" - it's OK and shows my external IP (xxx .158.136.144), not internal one (192.168.1.1)

Is it by design?

 

[RMerlin]

Hi All!

I am using Asus RT-AC68U with latest Merlin frimware. I have found a strange issue today.

According to Firewall General - Respond Ping Request from WAN is disabled. And it works OK - when I try to ping myself (xxx.asuscomm.com) from the world it fails.

But when I try to ping myself from internal network using "ping xxx.asuscomm.com" - it's OK and shows my external IP (xxx .158.136.144), not internal one (192.168.1.1)

Is it by design?

WAN refers to the interface, not the IP used by it. If you ping from your LAN, the packet never goes through the WAN interface and only hits the LAN interface, therefore you get a ping reply.

 

[gjf]

WAN refers to the interface, not the IP used by it. If you ping from your LAN, the packet never goes through the WAN interface and only hits the LAN interface, therefore you get a ping reply.

Yes, exactly, but why in this case I can see my WAN IP, not LAN one?
Let me explain. I execute from WAN side:

ping xxx.asuscomm.com

and see 100% loss because respond is disabled. It is OK.
Now I execute the same command from LAN side. And I see:

Respond from xxx.158.136.144: bytes=32 time<1ms TTL=64

Why I see xxx.158.136.144 - WAN IP and not 192.168.1.1 which is LAN IP of my router?

 

[RMerlin]

Yes, exactly, but why in this case I can see my WAN IP, not LAN one?
Let me explain. I execute from WAN side:

ping xxx.asuscomm.com

and see 100% loss because respond is disabled. It is OK.
Now I execute the same command from LAN side. And I see:

Respond from xxx.158.136.144: bytes=32 time<1ms TTL=64

Why I see xxx.158.136.144 - WAN IP and not 192.168.1.1 which is LAN IP of my router?

Because that is what you are pinging, the xxx.asuscomm.com DNS entry points to that WAN IP. Once the ICMP packet is inside the router (having come in through the LAN interface), it does not have to leave the router to access that IP - it's internal to the router. The ping packet never reaches the eth0 interface, the reply immediately comes back through the LAN interface.

The ICMP firewall rule only applies to the interface (eth0), not to the IP.

 

[gjf]

OK, got it, thanks.