Disable the ping response on the red interface?

[bbitsch (Bernhard Bitsch)]

@cfusco , no problem.
I think your statement gives a good overview about ICMP traffic.

[ummeegge (Erik Kapfer)]

Hi all,
@cfusco as an beneath information,i would also delete the rules or flush CUSTOMINPUT in “stop)” section in firewall.local to prevent duplicates of the same rules.

Best,

Erik

[gilligan (Matt G)]

Thank you all for the quick responses! And cfusco, you gave a great explanation about icmp.
I guess I was hopeful for a simple checkbox like what smoothwall had. Oh well, I don’t want to mess with config files right now. But if I do in the future, I can refer back to this thread now.
I also didn’t think of the idea that a lack of a response could be interpreted as something being there, so maybe it isn’t worth the trouble anymore anyway.
So far I am very happy with ipfire. Seems like it is the perfect replacement for our old smoothwall router.
Thank you all again.

[cfusco]

@ummeegge

Hi all,
@cfusco as an beneath information,i would also delete the rules or flush CUSTOMINPUT in “stop)” section in firewall.local to prevent duplicates of the same rules.

You are absolutely right. I have update the example code.

[ummeegge (Erik Kapfer)]

A short version can be

  stop)
        ## add your 'stop' rules here
        iptables -F CUSTOMINPUT

but may also good to list them all with the -D flag to make things more clear.

Best,

Erik

[cfusco]

@jon if you have no objection, where can we put this howto in the wiki?

[bbitsch (Bernhard Bitsch)]

A good place would be in wiki.ipfire.org - Tutorials and Learning Material for Newbies.
But this is mainly a page of links.
Another place could be the examples section of wiki.ipfire.org - Firewall Documentation.

[cfusco]

@bbitsch wiki.ipfire.org - ping

[bbitsch (Bernhard Bitsch)]

@cfusco , thx.
I’ve added a link to wikipedia. This rounds up the information for the interested user.

[cbrown (Charles Brown)]

There is an extraneous “i” at the start of the sample firewall.local file on the wiki.

i#!/bin/sh
# Used for private firewall rules
...

[bbitsch (Bernhard Bitsch)]

Corrected.

[jon]

The wiki placement looks good. Please add “not recommended” paragraph as the first paragraph.

I remember having problems with OpenVPN and it would not work with ping disabled. This was more than 5 years ago. I use IPSec these days so I dont know if this is still an issue.

I think Peter (or one of the Core Devs) wrote a Post about why disabling ping was a bad idea. I don’t remember if this was a Community post or a Dev List post…

---

EDIT:

ICMP is enabled by default on red

Hi, to my knowledge, the benefits of preventing a system to respond to ICMP echo-requests (type 8) are questionable indeed. However, blocking any ICMP traffic is indeed not a good idea, since this blocks signaling of messages such as “packet too big” and “destination host unreachable”. While IPv4 can be operated completely without ICMP, IPv6 cannot - there, one will have to permit some types of ICMPv6 if things should be operational. If I understood threads like this correctly, people commonl…

EDIT2:

Deactivating the rule does not work

ICMP is always allowed in the default policy even if you set the default to block. Only with an user rule it can blocked. But ICMP is not only for ping it also reports closed/unreachable messages and is used for mtu detection so you should not block it at all.

[cfusco]

@jon

Please add “not recommended” paragraph as the first paragraph.

Thank you @jon for your help. I’ve updated the wiki article to prominently feature the “not recommended” warning as the first paragraph, underscoring the general consensus against disabling ICMP.

The introduction has also been restructured to strongly advocate for the importance of maintaining network functionality. While my personal views strongly align with preserving ICMP, I’ve retained the technical details for those who opt to disable pings. This approach ensures that the article remains a comprehensive resource for everyone, irrespective of their stance on the issue.

Feel free to further intensify the language if you think it’s necessary.

[jon]

@cfusco

Thank you @jon for your help. I’ve updated the wiki article to prominently feature the “not recommended” warning as the first paragraph, underscoring the general consensus against disabling ICMP.

I did not see this on the ping wiki page… maybe it did not save?!?

[cfusco]

@jon

I did not see this on the ping wiki page… maybe it did not save?!?

i don’t know what happened. Now it should be there.

[bbitsch (Bernhard Bitsch)]

Is it clearer with sentence in bold?

[jon]

Ha! bolding helped - I missed it before!!

[cbrown (Charles Brown)]

Hmm, it seems the erroneous / extraneous ‘i’ has returned

[cfusco]

I don’t see the ‘i’ anymore. It looks fine to me. Maybe we can close this thread and hopefully never speak of this topic again, besides pointing to the wiki.