Disable the ping response on the red interface?

[jon]

The wiki placement looks good. Please add “not recommended” paragraph as the first paragraph.

I remember having problems with OpenVPN and it would not work with ping disabled. This was more than 5 years ago. I use IPSec these days so I dont know if this is still an issue.

I think Peter (or one of the Core Devs) wrote a Post about why disabling ping was a bad idea. I don’t remember if this was a Community post or a Dev List post…

---

EDIT:

ICMP is enabled by default on red

Hi, to my knowledge, the benefits of preventing a system to respond to ICMP echo-requests (type 8) are questionable indeed. However, blocking any ICMP traffic is indeed not a good idea, since this blocks signaling of messages such as “packet too big” and “destination host unreachable”. While IPv4 can be operated completely without ICMP, IPv6 cannot - there, one will have to permit some types of ICMPv6 if things should be operational. If I understood threads like this correctly, people commonl…

EDIT2:

Deactivating the rule does not work

ICMP is always allowed in the default policy even if you set the default to block. Only with an user rule it can blocked. But ICMP is not only for ping it also reports closed/unreachable messages and is used for mtu detection so you should not block it at all.