Re: ICMP types

[Alexander Samad <alex@samad.com.au>]

[-- Attachment #1: Type: text/plain, Size: 4253 bytes --]

On Sat, Apr 30, 2005 at 02:23:24PM +0200, Mogens Valentin wrote:
> Ken Hilliard wrote:
> > In reading different firewall scripts/tutorials many of them recommend
> > filtering ICMP packets. I added ICMP filter in my firewall but was
> > unsure of the value as well. What is the consensus view out there?
> 
> Not wanting to comment what the consensus are, but some types are 
> generally considered nessesary to filter/allow.
> 
> But its really not just a matter of filtering this-or-that, also what's 
> set in /proc . There's a lot to read...
> A few ideas:
> 
> Filtering ICMP:
> 
> ### Define icmp_packets chain:
>     $IPT -F icmp_packets
>     $IPT -X icmp_packets
>     $IPT -N icmp_packets
>     $IPT -A icmp_packets -p icmp --icmp-type echo-request -j ACCEPT
>     $IPT -A icmp_packets -p icmp --icmp-type echo-reply -j ACCEPT
>     $IPT -A icmp_packets -p icmp --icmp-type destination-unreachable -j 
> ACCEPTlog
>     $IPT -A icmp_packets -p icmp --icmp-type network-unreachable -j 
> ACCEPTlog
>     $IPT -A icmp_packets -p icmp --icmp-type network-prohibited -j 
> ACCEPTlog
>     $IPT -A icmp_packets -p icmp --icmp-type source-quench -j ACCEPTlog
>     $IPT -A icmp_packets -p icmp --icmp-type parameter-problem -j ACCEPTlog
>     $IPT -A icmp_packets -p icmp --icmp-type time-exceeded -j ACCEPTlog
>     $IPT -A icmp_packets -p icmp --icmp-type fragmentation-needed -j 
> ACCEPTlog
>     #$IPT -A icmp_packets -p icmp -j ACCEPTlog
>     $IPT -A icmp_packets -p icmp -j LOG


why not use
-m limit --limit 1/s --limit-burst 5 
as well to limit them and then drop the rest!

> 
> 
> 
> A few /proc settings:
> 
> ### /proc settings:
>     setup_procfs() {
> 
>       # Disable forwarding while setting up rules (needed for 
> masquerading):
>       # Note: this is now done in forwarding.def
>           #echo "0" >/proc/sys/net/ipv4/ip_forward
> 
>       # Initially, disable ICMP echo-requests altogether (normally only 
> used if DoSed):
>       # Note: this is now done in forwarding.def
>           #echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_all
> 
>       # Disable ICMP echo-request to broadcast addresses (Smurf amplifier):
>           echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
> 
>       # Enable syn-cookies (prevent syn-flood attacks):
>           echo "1" >/proc/sys/net/ipv4/tcp_syncookies
> 
>       # Reduce number of possible SYN Floods:
>           echo "1024" >/proc/sys/net/ipv4/tcp_max_syn_backlog
> 
>       # Enable defrag error protection:
>           echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
> 
>       # Enable time-wait assassination hazards in tcp (RFC 1337):
>           echo "1" >/proc/sys/net/ipv4/tcp_rfc1337
> 
>       # Prevent remote digging of OS-type and uptime (RFC1323):
>           #echo "1" >/proc/sys/net/ipv4/tcp_timestamps    # enable 
> timestamps
>           echo "0" >/proc/sys/net/ipv4/tcp_timestamps    # disable 
> timestamps
> 
>       # Disable RFC2018 TCP Selective Acknowledgements:
>           echo 0 > /proc/sys/net/ipv4/tcp_sack
> 
> 
>       # Sourcerouting and spoofing:
>           for i in /proc/sys/net/ipv4/conf/*; do
>               # Drop all source-routed packets:
>               echo "0" >$i/accept_source_route
> 
>               # Deactivate normal ICMP redirect accept/send:
>               echo "0" >$i/accept_redirects
>               echo "0" >$i/send_redirects
> 
>               # Activate secure ICMP redirects (send only?) (on by 
> default):
>               echo "1" >$i/secure_redirects
> 
>               # Enable ingress + egress source-address verification 
> (prevent spoofing):
>               #echo "0" >$i/rp_filter   # disable
>               echo "1" >$i/rp_filter   # enable
>           done
> 
>       # Log spoofed, source routed and redirect packets:
>           #echo 1 >/proc/sys/net/ipv4/conf/all/log_martians
>           echo 0 >/proc/sys/net/ipv4/conf/all/log_martians
> 
>     }
> 
> -- 
> Kind regards,
> Mogens Valentin
> 
> 
> Q: How does a hacker fix a function which doesn't
>    work for all of the elements in its domain?
> A: He changes the domain.
>   -- unknown
> 
> 
> 

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]