ICMP packets, what types to block?

[jspeicher]

I have a question. ICMP packets are very helpful but also are a security risk. Of all the types of ICMP, what are the top 5 types I should block? and why? thanks for any help or insight.

 

[n0cmonkey]

I don't like blocking any of them. I haven't found a good reason to do so yet. What class is this for?

 

[Garion]

Weeeel, that's a difficult one. I assume this is an INBOUND firewall rule, like one in front of a web server or load balancer. Outbound would be different.

ICMP can, inadvertently pass back more data than you want it to. Reading through the different ICMP packet types, there's actually a lot that I'd block and only a few that I'd allow.

Ones that I'd want to allow would be echo reply, echo, time exceeded, and traceroute. The destination unreachable is a good one, but it's the one that can send back more information that you might really want to send back, from a security perspective.

Decide what you want to let through, from a security and functionality perspective and only allow it. As a general rule, you ALWAYS block everything and permit only what you want through - Never, never the other way around.

- G

 

[spidey07]

yep, be very careful because blocking ICMP, especially time exceeded can break certain applications (specifically VPNs and tunneling)

I forget off the top of my head but there are ones that you should always allow, blocking all others. I do like the ability to ping though.

 

[jspeicher]

Thanks for the input guys, this is for a TCP/IP course....

 

[n0cmonkey]

Originally posted by: jspeicher
Thanks for the input guys, this is for a TCP/IP course....

So, what do you think about the question? Give us your answer and we can comment on that. We'll be nice.

 

[Boscoh]

Unreachables are used for PathMTU with VPN tunnels, so be careful about blocking that.

I dont block any of them inbound except echo, which I allow only to certain servers. The only real reason I block echo is because it is a trigger for many worms to start their infection process. Blocking echo doesnt do much good against a determined attacker..he'll likely figure out there is a system there anyhow.

Outbound I only allow echo, echo reply, unreachable, and time exceed.

A better option instead of blocking all ICMP might be to inspect the types you need to make sure it is legitimate for the type specified. Data can be encapsulated into an ICMP packet, and if you just make sure the ICMP packet conforms to RFC's then you should be ok.

Oh, and be careful about blocking fragmented echo's over VPN tunnels. MS Active Directory 2003 uses something like a 2500-byte ping to check the status of a host before pushing a group policy, since that wont fit in a single packet it has to be fragmented, and if you're blocking frag'd echos then you wont get group policies at the other end of the tunnel.