<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Funnily enough, I am preparing some routers for production and
configuring firewalls for this very reason, so have recently found a
list ready for ICMP blocking:<br>
<br>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<pre style="padding: 10px; border: 1px solid rgb(170, 170, 170); color: rgb(68, 68, 68); background-color: rgba(255, 255, 238, 0.701961); line-height: 1.2em; font-family: monospace, Courier, Arial; overflow-x: visible; margin: 12px 0px 12px 20px; width: 685.390625px; border-top-left-radius: 5px; border-top-right-radius: 5px; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; -webkit-box-shadow: rgb(192, 192, 192) 0px 0px 12px; box-shadow: rgb(192, 192, 192) 0px 0px 12px; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-position: initial initial; background-repeat: initial initial;">add chain=icmp protocol=icmp icmp-options=0:0 action=accept \
comment="echo reply"
add chain=icmp protocol=icmp icmp-options=3:0 action=accept \
comment="net unreachable"
add chain=icmp protocol=icmp icmp-options=3:1 action=accept \
comment="host unreachable"
add chain=icmp protocol=icmp icmp-options=3:4 action=accept \
comment="host unreachable fragmentation required"
add chain=icmp protocol=icmp icmp-options=4:0 action=accept \
comment="allow source quench"
add chain=icmp protocol=icmp icmp-options=8:0 action=accept \
comment="allow echo request"
add chain=icmp protocol=icmp icmp-options=11:0 action=accept \
comment="allow time exceed"
add chain=icmp protocol=icmp icmp-options=12:0 action=accept \
comment="allow parameter bad"
add chain=icmp action=drop comment="deny all other types"
</pre>
<br>
This is for RouterOS, gives 8 different types (and description) of
ICMP that you should allow then block the rest. Adjust for your own
operating system.<br>
<br>
Thanks,<br>
Joe<br>
<br>
<div class="moz-cite-prefix">On 20/05/14 14:03, Colin Stubbs wrote:<br>
</div>
<blockquote
cite="mid:CA+CbT+uxHFaBZbMcnCpH5qfYR1-3+518Z2iU1QXVW0kRcLQg3g@mail.gmail.com"
type="cite">
<p dir="ltr">ICMP is more than just echo requests and replies or
"ping" as so many think of it. </p>
<p dir="ltr">If you're dropping unreachables and time exceeded
error messages odds are your network won't work at all, or the
apps on top will perform badly while experiencing intermittent
problems. </p>
<p dir="ltr">With respect to "ping" I would deny echo request from
untrusted zones to anywhere, deny echo reply to untrusted from
anywhere, but allow echo request from trusted to anywhere with
echo reply from anywhere to trusted. </p>
<p dir="ltr">You could do something similar with ICMP traceroute
if you want to. UDP/TCP traceroute must be permitted by
firewalls along with letting the ICMP TTL exceeded and
unreachables pass unhindered. </p>
<p dir="ltr">Make sure you understand ICMP types and sub types
before you go trying to enforce any policy changes. </p>
<p dir="ltr"><a moz-do-not-send="true"
href="http://en.m.wikipedia.org/wiki/Internet_Control_Message_Protocol">http://en.m.wikipedia.org/wiki/Internet_Control_Message_Protocol</a></p>
<p dir="ltr">Policy based on geographical source, e.g. "i don't
trust China and have no need to communicate with Russia" is
increasingly common in enterprise... Not exactly feasible in
service provider land. </p>
<p dir="ltr">Sent from a mobile device. Correct spelling and
accurate use of grammar is unlikely to have occurred.</p>
<div class="gmail_quote">On 20/05/2014 1:37 pm, "Alex Samad -
Yieldbroker" <<a moz-do-not-send="true"
href="mailto:Alex.Samad@yieldbroker.com">Alex.Samad@yieldbroker.com</a>>
wrote:<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi<br>
<br>
Wondering what people do around<br>
1) letting through icmp<br>
<br>
I like the idea of allowing icmp through, make network
diagnosis a lot easier, but I don't want to be bomb.<br>
What sort of rate limiting do people think is acceptable?<br>
What's acceptable from client to confirm connectivity?<br>
<br>
<br>
2) blacklisting ip's<br>
<br>
So I have (like a lot of others), people port scanning look
for open ports, what sort of levels do people actually do
something about it ?<br>
<br>
I asking as an end user, but I am also curious to know what
providers do.<br>
<br>
I have heard of companies blocking entire ranges, for example
say china and/or Russia as they have no clients there. Do
people do that, do ISP provide that service (can that be done
through the auto black hole mechanism ?)<br>
<br>
<br>
Alex<br>
_______________________________________________<br>
AusNOG mailing list<br>
<a moz-do-not-send="true"
href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a moz-do-not-send="true"
href="http://lists.ausnog.net/mailman/listinfo/ausnog"
target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</blockquote>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
AusNOG mailing list
<a class="moz-txt-link-abbreviated" href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a>
<a class="moz-txt-link-freetext" href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
</pre>
</blockquote>
<br>
</body>
</html>