ICMP is enabled by default on red

Hi,

to my knowledge, the benefits of preventing a system to respond to ICMP echo-requests (type 8) are questionable indeed.

However, blocking any ICMP traffic is indeed not a good idea, since this blocks signaling of messages such as “packet too big” and “destination host unreachable”. While IPv4 can be operated completely without ICMP, IPv6 cannot - there, one will have to permit some types of ICMPv6 if things should be operational.

If I understood threads like this correctly, people commonly try to drop responds to ping to hide themselves from scanners or attackers. First of all, this won’t work if there is any port exposed to the internet on IPFire - if a destination does not respond to a ping, but to a TCP connect on a certain port, it is online indeed. There would be no sense in dropping the ping in the first place.

Second, “hiding” a system or making it “stealthy” (as some CPE configuration interfaces name this functionality) reminds me of “security by obscurity”, which neither is secure nor obscure in the end.

Yes, back in the 2000s, there were some nasty ICMP-based attacks. However, we can now deal with them (IPFire certainly can :wink: ), and I believe the benefits of permitting ICMP replies to type 8 outweigh the security implications.

Thanks, and best regards,
Peter Müller

P.S.: IPFire tries to ping its configured gateway, for example. I believe it is for statistical purposes only, and some mechanisms such as PPPoE bring their own ping-alike functionality to detect connection loss.

7 Likes