on Firewall.unix.co.nz (freebsd using ipfw) I want to block traceroute (from windows machines) to 60.234.68.89/29 Current view traceroute to 60.234.68.90 (60.234.68.90), 30 hops max, 40 byte packets 1 vlan250.lon-service6.Melbourne.telstra.net (203.50.2.177) 0.341 ms 0.187 ms 0.256 ms 2 * TenGigE0-12-0-2.win-core1.Melbourne.telstra.net (203.50.79.129) 1.105 ms 1.002 ms 3 * Bundle-Pos1.ken-core4.Sydney.telstra.net (203.50.6.21) 13.879 ms 13.721 ms 4 TenGigabitEthernet9-2.ken12.Sydney.telstra.net (203.50.20.22) 13.181 ms 13.213 ms 13.146 ms 5 optus4.lnk.telstra.net (139.130.65.146) 13.207 ms 13.055 ms 13.166 ms 6 61.88.221.205 (61.88.221.205) 13.504 ms 14.464 ms 13.531 ms 7 61.88.133.206 (61.88.133.206) 13.956 ms 13.619 ms 13.671 ms 8 gi3-1.cr2.syd1.asianetcom.net (202.147.40.142) 14.107 ms 14.058 ms 13.973 ms 9 so-0-0-0-0.gw4.akl1.asianetcom.net (202.147.55.253) 37.197 ms 37.368 ms 75.937 ms 10 Orcon-Internet.gw4.AKL1.asianetcom.net (203.192.166.70) 37.845 ms 38.586 ms 37.753 ms 11 60.234.9.6 (60.234.9.6) 37.964 ms 38.258 ms 38.215 ms 12 firewall.unix.co.nz (60.234.66.130) 38.407 ms 38.098 ms 38.045 ms <--- system running IPFW 13 cisco.unix.co.nz (60.234.68.254) 38.584 ms 38.428 ms 38.338 ms 14 60.234.68.90 (60.234.68.90) 38.28 ms 38.266 ms 38.271 ms Desired view traceroute to 60.234.68.90 (60.234.68.90), 30 hops max, 40 byte packets 1 vlan250.lon-service6.Melbourne.telstra.net (203.50.2.177) 0.341 ms 0.187 ms 0.256 ms 2 * TenGigE0-12-0-2.win-core1.Melbourne.telstra.net (203.50.79.129) 1.105 ms 1.002 ms 3 * Bundle-Pos1.ken-core4.Sydney.telstra.net (203.50.6.21) 13.879 ms 13.721 ms 4 TenGigabitEthernet9-2.ken12.Sydney.telstra.net (203.50.20.22) 13.181 ms 13.213 ms 13.146 ms 5 optus4.lnk.telstra.net (139.130.65.146) 13.207 ms 13.055 ms 13.166 ms 6 61.88.221.205 (61.88.221.205) 13.504 ms 14.464 ms 13.531 ms 7 61.88.133.206 (61.88.133.206) 13.956 ms 13.619 ms 13.671 ms 8 gi3-1.cr2.syd1.asianetcom.net (202.147.40.142) 14.107 ms 14.058 ms 13.973 ms 9 so-0-0-0-0.gw4.akl1.asianetcom.net (202.147.55.253) 37.197 ms 37.368 ms 75.937 ms 10 Orcon-Internet.gw4.AKL1.asianetcom.net (203.192.166.70) 37.845 ms 38.586 ms 37.753 ms 11 60.234.9.6 (60.234.9.6) 37.964 ms 38.258 ms 38.215 ms 12 * * * 13 * * * 14 60.234.68.90 (60.234.68.90) 38.28 ms 38.266 ms 38.271 ms However I only want to block ICMP (traceroute) if the dst=60.234.68.89/29 not any other traceroutes, i.e. I don't want to block those 2 host above if someone was tracing to 60.234.68.0/29