Allowing ping

Allowing ping

[Askar Ali]

hi list,

        I have a very simple question, presently we are blocking icmp 
"ping" on our servers. But as far I can userderstand its not very good 
practice or providing a good security by blocking ping request. see one 
can ping www.xyz.com and get the reply back.

However Before allowing ping "echo-request" I just want to confirm 
whether doing ...

iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

would be enough or doing some rate limiting would be better?

Any help in this regard  will greatly appreciated.

regards

Askar Ali

Re: Allowing ping

[/dev/rob0]

On Tuesday 2005-October-25 12:32, Askar Ali wrote:
> I have a very simple question, presently we are blocking icmp
> "ping" on our servers. But as far I can userderstand its not very
> good practice or providing a good security by blocking ping request.

I agree. Blocking pings is like shooting yourself in the foot.  You 
never know when you will need ping. Some think it's a good idea to try 
to hide. Rubbish, if you have any open services, the bots and worms 
will find you anyway.

> see one can ping www.xyz.com and get the reply back.
>
> However Before allowing ping "echo-request" I just want to confirm
> whether doing ...
>
> iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
>
> would be enough or doing some rate limiting would be better?

I think a reasonable --limit is not a bad idea, but there is no 
objective measurement of "better". I use a --limit on incoming ping 
requests. It might help in the event of a flood ping attack, and you 
can still ping to verify your connectivity when you need it.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

RE: Allowing ping

[Pablo Sanchez]

> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org]On Behalf Of /dev/rob0
> Sent: Wednesday, October 26, 2005 11:56 AM
> To: netfilter@lists.netfilter.org
> Subject: Re: Allowing ping
> 
> I think a reasonable --limit is not a bad idea, but there is no 
> objective measurement of "better". I use a --limit on incoming ping 
> requests. It might help in the event of a flood ping attack, and you 
> can still ping to verify your connectivity when you need it.

I believe it marginally helps during an attack.  If you're DDOS, the packets are still reaching your NIC so you're kinda hosed anyway.
---
Pablo Sanchez - Blueoak Database Engineering, Inc
Ph:    819.459.1926          Toll free:  888.459.1926
Cell:  819.664.9118                Pgr:  pablo_p@blueoakdb.com
Fax:   603.720.7723 (US)           Fax:  514.371.1255 (Canada)

Re: Allowing ping

[Askar]

hi rob

would you pls share your iptables rules that dealng incoming pings ?


On 10/26/05, /dev/rob0 <rob0@gmx.co.uk> wrote:
> On Tuesday 2005-October-25 12:32, Askar Ali wrote:
> > I have a very simple question, presently we are blocking icmp
> > "ping" on our servers. But as far I can userderstand its not very
> > good practice or providing a good security by blocking ping request.
>
> I agree. Blocking pings is like shooting yourself in the foot.  You
> never know when you will need ping. Some think it's a good idea to try
> to hide. Rubbish, if you have any open services, the bots and worms
> will find you anyway.
>
> > see one can ping www.xyz.com and get the reply back.
> >
> > However Before allowing ping "echo-request" I just want to confirm
> > whether doing ...
> >
> > iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
> >
> > would be enough or doing some rate limiting would be better?
>
> I think a reasonable --limit is not a bad idea, but there is no
> objective measurement of "better". I use a --limit on incoming ping
> requests. It might help in the event of a flood ping attack, and you
> can still ping to verify your connectivity when you need it.
> --
>     mail to this address is discarded unless "/dev/rob0"
>     or "not-spam" is in Subject: header
>
>


--
Unix is very simple, but it takes a genius to understand the simplicity.
(Dennis Ritchie)