Contents
Should I block ICMP on firewall?
Many network administrators feel that ICMP is a security risk, and should therefore always be blocked at the firewall. It is true that ICMP does have some security issues associated with it, and that a lot of ICMP should be blocked.
How do I stop iptables ICMP traffic?
Firewall iptables rules
- Stop all incoming traffic using the following command: iptables -P INPUT DROP.
- Stop all forwarding by using the following command: iptables -P FORWARD DROP.
- Allow output traffic for ICMP by using the following command: iptables -A OUTPUT -p icmp -j ACCEPT.
Is it bad idea to block ICMP ping?
There is several reason why you should not block ICMP if you are not absolute sure what you are doing and specially why you are doing. Yes icmp ping can help others to “profile” your network. But lets be honest, if you have any tcp service open at all you will be seen.
Are there books that suggest to block all ICMP packets?
Books that suggest to block all icmp packets are 1) written by stupid people or 2) written by people to make your network hard for diagnostics and to make you call a company that will fix it for you 🙂 even icmp redirect messages are not harmful if you have only static routes…
Are there any ports in the ICMP protocol?
ICMP has no ports and is neither TCP nor UDP. ICMP is IP protocol 1 (see RFC792), TCP is IP protocol 6 (described in RFC793) and UDP is IP protocol 17(see RFC768). UDP and TCP have ports, ICMP has no ports, but types and codes. I would say: don’t filter ICMP until you know exactlywhat you are doing.
How can ICMP ping help others to profile your network?
Yes icmp ping can help others to “profile” your network. But lets be honest, if you have any tcp service open at all you will be seen. If you just drop packets you will be seen. If you response wrong way you will be seen.