Re: Preparing for Default Deny Firewall

[Jeff Kell <jeff-kell () UTC EDU>]

Scholz, Greg wrote:
> I am looking at the same situation.  Does anyone have a recommendation
> for ICMP types/codes in general?

You may elect to be more restrictive, but essentially:

>    remark Secure ICMP (http://www.cymru.com/Documents/icmp-messages.html)
>    remark Specifically block ICMP fragments
>    deny   icmp any any fragments
>    remark  permit inbound ping
>    permit icmp any any echo
>    remark  permit inbound ping response
>    permit icmp any any echo-reply
>    remark  permit Path MTU to function
>    permit icmp any any packet-too-big
>    remark  permit flow control
>    permit icmp any any source-quench
>    remark  permit time exceeded messages for traceroute and loops
>    permit icmp any any time-exceeded
>    remark And explicitly block all other ICMP packets
>    deny   icmp any any

Jeff

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.