Firewall Wizards mailing list archives

Blocking ICMP with ipchains


From: wwebb () adni net
Date: Tue, 11 Jan 2000 19:18:59 -0500

I've heard that it is not wise to block all ICMP operations.  Such 
being the case, which of these ICMP operations are safe to block 
without causing serious problems: 

echo-reply (pong)
destination-unreachable
   network-unreachable
   host-unreachable
   protocol-unreachable
   port-unreachable
   fragmentation-needed
   source-route-failed
   network-unknown
   host-unknown
   network-prohibited
   host-prohibited
   TOS-network-unreachable
   TOS-host-unreachable
   communication-prohibited
   host-precedence-violation
   precedence-cutoff
source-quench
redirect
   network-redirect
   host-redirect
   TOS-network-redirect
   TOS-host-redirect
echo-request (ping)
router-advertisement
router-solicitation
time-exceeded (ttl-exceeded)
   ttl-zero-during-transit
   ttl-zero-during-reassembly
parameter-problem
   ip-header-bad
   required-option-missing
timestamp-request
timestamp-reply
address-mask-request
address-mask-reply

Thanks for any assistance.




Current thread: