ICMP: What should be blocked?

ICMP: What should be blocked?

[Jean-Christian Imbeault]

I been googling the web trying to find what rules I should set up for 
ICMP but I've seen some people say one thing while other say something 
completely different.

One question I have not been able to find an answer to though, should I 
block ICMP messages of type 11 (TTL exceeded)?

Also if anyone knows of a good resource that explains what ICMP messages 
I should block (why and how :) could they let me know? I understand that 
it of course depends on my level of paranoia and how friendly I want to 
be to the rest of the net, but I get the feeling from my readings that 
the are some ICMP messages that just should not be let through a 
firewall ....

Thanks,

Jc

Re: ICMP: What should be blocked?

[Maciej Soltysiak]

Hi,

in my opinion icmp is the easiest to set up for.

1) Allow all ICMP that is related to connections issued by the protected net
2) Allow echo requests if you wish.
3) Block all other by default.

-p icmp -m state --state RELATED -j ACCEPT

> One question I have not been able to find an answer to though, should I
> block ICMP messages of type 11 (TTL exceeded)?
Only if they are really responses to packets sent by the router or your
protected hosts. Otherwise they may be inverse mapping attempts and should
be blocked. Of course it is only possible to filter with the -m state.


> Also if anyone knows of a good resource that explains what ICMP messages
> I should block (why and how :) could they let me know?
www.sys-security.com/archive/papers/ICMP_Scanning_v3.0.pdf
And other articles by Ofir Arkin about ICMP.

> I understand that it of course depends on my level of paranoia
> and how friendly I want to be to the rest of the net, but I get the
> feeling from my readings that the are some ICMP messages that just
> should not be let through a firewall ....
Paranoia? No, just be statefull. Allow what is required by the undergoing
connections, disallow what is not.

That is the easiest way to protect yourself from inverse mapping, stealing
routes with icmp redirects, OS fingerprinting. This way you do not need
explicit rules for eg. timestamp requests, etc. (which are recommended to
be blocked), they will just not pass through the stateful mechanism of
iptables.

The statefulness of iptables is _very_ often not used by users, especially
by ipchains users. It makes everything go smoother, make rulesets simpler,
and chain parsing faster.

Regards,
Maciej Soltysiak

Re: ICMP: What should be blocked?

[Manuel Samper]

Jean-Christian Imbeault, on Wednesday, Mar  5 2003 at 08:09, wrote:
> I been googling the web trying to find what rules I should set up for 
> ICMP but I've seen some people say one thing while other say something 
> completely different.
> 
> One question I have not been able to find an answer to though, should I 
> block ICMP messages of type 11 (TTL exceeded)?
> 
> Also if anyone knows of a good resource that explains what ICMP messages 
> I should block (why and how :) could they let me know? I understand that 
> it of course depends on my level of paranoia and how friendly I want to 
> be to the rest of the net, but I get the feeling from my readings that 
> the are some ICMP messages that just should not be let through a 
> firewall ....

Here are a good start point:
http://www.sns.ias.edu/~jns/security/iptables/iptables_conntrack.html#ICMP
http://www.sns.ias.edu/~jns/security/iptables/rules.html

Although it's somewhat paranoid with icmp (e.g. the icmp_echo_ignore_all),
you can tune it to your needs.

(note also that the REJECT rule of auth port found there needs an output one
 with an OUTPUT DROP default policy, something like:
 iptables -A OUTPUT -o $IFACE -p tcp -m state --st REL --sp ident -j ACCEPT)

	Manuel