on Firewall.unix.co.nz (freebsd using ipfw) I want to block traceroute (from windows machines) to 60.234.68.89/29
Current view
traceroute to 60.234.68.90 (60.234.68.90), 30 hops max, 40 byte packets
1 vlan250.lon-service6.Melbourne.telstra.net (203.50.2.177) 0.341 ms 0.187 ms 0.256 ms
2 * TenGigE0-12-0-2.win-core1.Melbourne.telstra.net (203.50.79.129) 1.105 ms 1.002 ms
3 * Bundle-Pos1.ken-core4.Sydney.telstra.net (203.50.6.21) 13.879 ms 13.721 ms
4 TenGigabitEthernet9-2.ken12.Sydney.telstra.net (203.50.20.22) 13.181 ms 13.213 ms 13.146 ms
5 optus4.lnk.telstra.net (139.130.65.146) 13.207 ms 13.055 ms 13.166 ms
6 61.88.221.205 (61.88.221.205) 13.504 ms 14.464 ms 13.531 ms
7 61.88.133.206 (61.88.133.206) 13.956 ms 13.619 ms 13.671 ms
8 gi3-1.cr2.syd1.asianetcom.net (202.147.40.142) 14.107 ms 14.058 ms 13.973 ms
9 so-0-0-0-0.gw4.akl1.asianetcom.net (202.147.55.253) 37.197 ms 37.368 ms 75.937 ms
10 Orcon-Internet.gw4.AKL1.asianetcom.net (203.192.166.70) 37.845 ms 38.586 ms 37.753 ms
11 60.234.9.6 (60.234.9.6) 37.964 ms 38.258 ms 38.215 ms
12 firewall.unix.co.nz (60.234.66.130) 38.407 ms 38.098 ms 38.045 ms <--- system running IPFW
13 cisco.unix.co.nz (60.234.68.254) 38.584 ms 38.428 ms 38.338 ms
14 60.234.68.90 (60.234.68.90) 38.28 ms 38.266 ms 38.271 ms
Desired view
traceroute to 60.234.68.90 (60.234.68.90), 30 hops max, 40 byte packets
1 vlan250.lon-service6.Melbourne.telstra.net (203.50.2.177) 0.341 ms 0.187 ms 0.256 ms
2 * TenGigE0-12-0-2.win-core1.Melbourne.telstra.net (203.50.79.129) 1.105 ms 1.002 ms
3 * Bundle-Pos1.ken-core4.Sydney.telstra.net (203.50.6.21) 13.879 ms 13.721 ms
4 TenGigabitEthernet9-2.ken12.Sydney.telstra.net (203.50.20.22) 13.181 ms 13.213 ms 13.146 ms
5 optus4.lnk.telstra.net (139.130.65.146) 13.207 ms 13.055 ms 13.166 ms
6 61.88.221.205 (61.88.221.205) 13.504 ms 14.464 ms 13.531 ms
7 61.88.133.206 (61.88.133.206) 13.956 ms 13.619 ms 13.671 ms
8 gi3-1.cr2.syd1.asianetcom.net (202.147.40.142) 14.107 ms 14.058 ms 13.973 ms
9 so-0-0-0-0.gw4.akl1.asianetcom.net (202.147.55.253) 37.197 ms 37.368 ms 75.937 ms
10 Orcon-Internet.gw4.AKL1.asianetcom.net (203.192.166.70) 37.845 ms 38.586 ms 37.753 ms
11 60.234.9.6 (60.234.9.6) 37.964 ms 38.258 ms 38.215 ms
12 * * *
13 * * *
14 60.234.68.90 (60.234.68.90) 38.28 ms 38.266 ms 38.271 ms
However I only want to block ICMP (traceroute) if the dst=60.234.68.89/29 not any other traceroutes, i.e. I don't want to block those 2 host above if someone was tracing to 60.234.68.0/29