# Why i cant block only one direction conexion? **URL:** \ **Category:** Rules\ **Tags:** rules\ **Created:** [March 30, 2022, 10:01am UTC](https://forum.suricata.io/t/why-i-cant-block-only-one-direction-conexion/2359 "2022-03-30T10:01:36Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Mestre](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/mestre/32/1366_2.png) [@Mestre](https://forum.suricata.io/u/Mestre)\ **Post date:** [March 30, 2022, 10:01am UTC](https://forum.suricata.io/t/why-i-cant-block-only-one-direction-conexion/2359/1 "2022-03-30T10:01:36Z")
I have these rules: ```auto drop ICMP $HOME_NET any -> $TREX_NET any (msg:"ping dropeado ";sid: 200002;rev:1;) pass ICMP $TREX_NET any -> $HOME_NET any (msg:"ping trex a home net";sid:200008;) ``` so I want to block home net to Trex net but I want to receive pings from Trex net to Home net but with this config, the two ways are allowed ---
**Author:** ![suricatalfon](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/suricatalfon/32/385_2.png) [@suricatalfon](https://forum.suricata.io/u/suricatalfon)\ **Post date:** [March 30, 2022, 10:31am UTC](https://forum.suricata.io/t/why-i-cant-block-only-one-direction-conexion/2359/2 "2022-03-30T10:31:19Z")
Hola, Nacho. - Es posible que ICMP lo tengas que poner en minúscula en la regla? - Revisaría también, en el .yaml, el action-order. - Para dropear no debe estar en modo IPS ? Saludos, ---
**Author:** ![Mestre](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/mestre/32/1366_2.png) [@Mestre](https://forum.suricata.io/u/Mestre)\ **Post date:** [March 30, 2022, 10:38am UTC](https://forum.suricata.io/t/why-i-cant-block-only-one-direction-conexion/2359/3 "2022-03-30T10:38:47Z")
Vale mi problema ha sido la definicion de la red TREX\_NET, gracias por tu respuesta igualmente