Handling Port-Unreachable Response to UDP

[Tim Burress <tim@variosecure.net>]

Hello!

We've been looking at a problem in which a client sends a UDP packet to 
a server on an unused port. This generates an ICMP port-unreachable 
packet (as usual), but we find that this same ICMP packet can then be 
replayed back to the client over and over. Apparently it gets through 
netfilter because our standard rules allow RELATED traffic.

We're wondering if an appropriate response to this situation would be to 
destroy the conntrack entry for the UDP connection after receiving the 
first port-unreachable? It seems like such a change would improve the 
strength of netfilter-based firewalls, while adding only a little bit of 
overhead when/if the client retries sending to the same UDP port several 
times. What do people think of this idea? Is there any reason not to do it?

Thanks!

Tim