Where is ping response coming from?

[Ronald Sutton]

I've got an ASUS RT-AC88U Router running ASUS-WRT Merlin 384.10, and I'm using port forwarding to put a device I'm developing on the Internet so script-kiddies can help me test my code. Today I turned off the device's ping response to see if that got less attention and was surprised to see that if I ping its Internet-facing IP address I get a response.

I do NOT get a response if I ping the device's LAN address, and have verified that the router's PING response is disabled (see attached image).

Any thoughts about where the response might be coming from?

 

[RMerlin]

Make sure you ping from outside of the network, not inside.

 

[Ronald Sutton]

Had my wife do that from work, and it times out. Can you help me understand where the response comes from, and why? As I mentioned above, the device is configured not to respond to a ping and when I ping its LAN address from inside the network I get no response. I see that I can ping the router from the LAN though.

 

[ColinTaylor]

@Ronald Sutton You are making confusing and contradictory statements. Maybe you need to be more specific.

You said "if I ping its Internet-facing IP address I get a response" and then "Had my wife do that from work, and it times out".

You also said "when I ping its LAN address from inside the network I get no response" and then "I can ping the router from the LAN though".

Those appear to be contradictions. Maybe you need to specify exactly what IP address you are pinging (i.e. WAN public IP or router's LAN IP) and from where (inside your LAN or outside).

 

[Ronald Sutton]

Thanks for your interest but RMerlin's response helped me understand this. Apparently the router always responds to pings originating on the LAN, even if they're directed to its WAN address.

 

[RMerlin]

Thanks for your interest but RMerlin's response helped me understand this. Apparently the router always responds to pings originating on the LAN, even if they're directed to its WAN address.

The firewall rule to drop ICMP is on the WAN interface. If you ping from inside your network, your traffic doesn't go through the WAN interface, it stays within your network, ignoring the firewall rule to drop it.