Re: ICMP types

[Mogens Valentin <monz@danbbs.dk>]

Ken Hilliard wrote:
 > In reading different firewall scripts/tutorials many of them recommend
 > filtering ICMP packets. I added ICMP filter in my firewall but was
 > unsure of the value as well. What is the consensus view out there?

Not wanting to comment what the consensus are, but some types are 
generally considered nessesary to filter/allow.

But its really not just a matter of filtering this-or-that, also what's 
set in /proc . There's a lot to read...
A few ideas:

Filtering ICMP:

### Define icmp_packets chain:
     $IPT -F icmp_packets
     $IPT -X icmp_packets
     $IPT -N icmp_packets
     $IPT -A icmp_packets -p icmp --icmp-type echo-request -j ACCEPT
     $IPT -A icmp_packets -p icmp --icmp-type echo-reply -j ACCEPT
     $IPT -A icmp_packets -p icmp --icmp-type destination-unreachable -j 
ACCEPTlog
     $IPT -A icmp_packets -p icmp --icmp-type network-unreachable -j 
ACCEPTlog
     $IPT -A icmp_packets -p icmp --icmp-type network-prohibited -j 
ACCEPTlog
     $IPT -A icmp_packets -p icmp --icmp-type source-quench -j ACCEPTlog
     $IPT -A icmp_packets -p icmp --icmp-type parameter-problem -j ACCEPTlog
     $IPT -A icmp_packets -p icmp --icmp-type time-exceeded -j ACCEPTlog
     $IPT -A icmp_packets -p icmp --icmp-type fragmentation-needed -j 
ACCEPTlog
     #$IPT -A icmp_packets -p icmp -j ACCEPTlog
     $IPT -A icmp_packets -p icmp -j LOG



A few /proc settings:

### /proc settings:
     setup_procfs() {

       # Disable forwarding while setting up rules (needed for 
masquerading):
       # Note: this is now done in forwarding.def
           #echo "0" >/proc/sys/net/ipv4/ip_forward

       # Initially, disable ICMP echo-requests altogether (normally only 
used if DoSed):
       # Note: this is now done in forwarding.def
           #echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_all

       # Disable ICMP echo-request to broadcast addresses (Smurf amplifier):
           echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

       # Enable syn-cookies (prevent syn-flood attacks):
           echo "1" >/proc/sys/net/ipv4/tcp_syncookies

       # Reduce number of possible SYN Floods:
           echo "1024" >/proc/sys/net/ipv4/tcp_max_syn_backlog

       # Enable defrag error protection:
           echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

       # Enable time-wait assassination hazards in tcp (RFC 1337):
           echo "1" >/proc/sys/net/ipv4/tcp_rfc1337

       # Prevent remote digging of OS-type and uptime (RFC1323):
           #echo "1" >/proc/sys/net/ipv4/tcp_timestamps    # enable 
timestamps
           echo "0" >/proc/sys/net/ipv4/tcp_timestamps    # disable 
timestamps

       # Disable RFC2018 TCP Selective Acknowledgements:
           echo 0 > /proc/sys/net/ipv4/tcp_sack


       # Sourcerouting and spoofing:
           for i in /proc/sys/net/ipv4/conf/*; do
               # Drop all source-routed packets:
               echo "0" >$i/accept_source_route

               # Deactivate normal ICMP redirect accept/send:
               echo "0" >$i/accept_redirects
               echo "0" >$i/send_redirects

               # Activate secure ICMP redirects (send only?) (on by 
default):
               echo "1" >$i/secure_redirects

               # Enable ingress + egress source-address verification 
(prevent spoofing):
               #echo "0" >$i/rp_filter   # disable
               echo "1" >$i/rp_filter   # enable
           done

       # Log spoofed, source routed and redirect packets:
           #echo 1 >/proc/sys/net/ipv4/conf/all/log_martians
           echo 0 >/proc/sys/net/ipv4/conf/all/log_martians

     }

-- 
Kind regards,
Mogens Valentin


Q: How does a hacker fix a function which doesn't
    work for all of the elements in its domain?
A: He changes the domain.
   -- unknown