Re: ICMP Packets.

[john_smith () rd qms com]

        It hit me two minutes after I clicked on send that I hadn't worded 
     my previous email correctly.  Hadn't had enough caffeine yet.  :(
     
        We allow *outbound*:
     
     - echo (type 8/code 0)
     - parameter-problem (12/[0|1])
     - source-quench (4/0)
     - ttl-exceeded (11/[0|1])
     
        and deny all other ICMP outbound.
     
        Inbound we allow all ICMP.
     
        This allows us to ping sites and allows our customers to get basic 
     error messages.
     
        Given the wording below this is the exact opposite of our policy.  
     Guess I'm going to have to rethink some things.  At least this list 
     does seem to work for us.
     
           Once again please let me know if you spot any problems with this 
     list.
     
        If I've gotten anything wrong again please let me know and I'll go 
     back home and go back to bed.  ;)
     
     jcs
     
     
     ______________________________ Forward Header _______________________
     Subject: Re: ICMP Packets.
     Author:  john smith at QMS-RD
     Date:    6/5/98 8:01 AM


        I knew I had seen this thread before.  Searched my personal 
     archives and came across it in the Firewalls Digest (V6 #295, #299, 
     #304 and #305) under the thread titled "what ICMP should i allow 
     through?".  Based on that discussion we modified our filter rules as 
     follows:
     
     Inbound Allow:
     
     - echo (type 8/code 0)
     - parameter-problem (12/[0|1])
     - source-quench (4/0)
     - ttl-exceeded (11/[0|1])
     
     Deny all other inbound ICMP.
     
     Outbound we allow all ICMP packets.
     
        This complies with our policy of permit all outbound and deny all 
     inbound except what is specifically permitted.  This list works *for 
     us* and does not seem to cause any connection problems (at least no 
     customer connectivity complaints).
     
        If any of you spot any obvious problems with this please point them 
     out.
     
     jcs
     
     John C. Smith
     Sys Admin/Jack-of-all-trades
     QMS, Inc.
     1 Magnum Pass
     Mobile, AL  36618, USA
     (334) 633-4300
     john_smith () rd qms com