224 lines
14 KiB
HTML
224 lines
14 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<!-- The above 3 meta tags *must* come first in the head; any other head content must come *after* these tags -->
|
|
<meta name="description" content="Should I block ICMP">
|
|
<meta name="author" content="Jason Ashworth">
|
|
<meta name="keywords" content="ICMP,traceroute,blackhole,traffic,ping,NDP,SLAAC,PMTUD,IPv4,IPv6,MTU,MSS,PLPMTUD">
|
|
|
|
<title>Should I block ICMP?</title>
|
|
|
|
<!-- Latest compiled and minified CSS -->
|
|
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.4/css/bootstrap.min.css">
|
|
|
|
<!-- Optional theme -->
|
|
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.4/css/bootstrap-theme.min.css">
|
|
|
|
<!-- Google JavaScript -->
|
|
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js"></script>
|
|
|
|
<!-- Latest compiled and minified JavaScript -->
|
|
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.4/js/bootstrap.min.js"></script>
|
|
|
|
<style>
|
|
body {
|
|
position: relative;
|
|
}
|
|
ul.nav-pills {
|
|
top: 80px;
|
|
position: fixed;
|
|
}
|
|
</style>
|
|
</head>
|
|
|
|
<body data-spy="scroll" data-target="#myScrollspy" data-offset="80">
|
|
|
|
<header class="navbar navbar-inverse navbar-fixed-top">
|
|
<div class="container">
|
|
<div class="navbar-header">
|
|
<button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#navbar" aria-expanded="false" aria-controls="navbar">
|
|
<span class="sr-only">Toggle navigation</span>
|
|
<span class="icon-bar"></span>
|
|
<span class="icon-bar"></span>
|
|
<span class="icon-bar"></span>
|
|
</button>
|
|
<a class="navbar-brand" href="#">ShouldIBlockICMP.com</a>
|
|
</div>
|
|
<div id="navbar" class="collapse navbar-collapse">
|
|
<ul class="nav navbar-nav">
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
</header>
|
|
|
|
<div class="container">
|
|
<div class="row">
|
|
<nav class="col-md-3 visible-md visible-lg" id="myScrollspy">
|
|
<ul class="nav nav-pills nav-stacked">
|
|
<li class="active"><a href="#TheProblem">The Problem</a></li>
|
|
<li><a href="#EchoReqReply">Echo Request and Reply</a></li>
|
|
<li><a href="#FragNeed">Fragmentation Needed</a></li>
|
|
<li><a href="#TimeExc">Time Exceeded</a></li>
|
|
<li><a href="#NDP">NDP and SLAAC</a></li>
|
|
<li><a href="#RateLim">Rate Limiting</a></li>
|
|
<li><a href="#Read">Reading and Research</a></li>
|
|
</ul>
|
|
</nav>
|
|
|
|
<div class="col-md-9">
|
|
<div class="text-center">
|
|
<br><br><br><br><br><br>
|
|
<h2>Should I block ICMP?</h2>
|
|
<br><br>
|
|
<h1>No!!</h1>
|
|
<br><br><br>
|
|
</div>
|
|
|
|
<div id="TheProblem">
|
|
<h4>The Problem</h4>
|
|
<p>Many network administrators feel that ICMP is a security risk, and should therefore always be blocked
|
|
at the firewall. It is true that ICMP does have some security issues associated with it, and that a lot
|
|
of ICMP should be blocked. But this is no reason to block all ICMP traffic!</p>
|
|
<p>ICMP has many important features; some are useful for troubleshooting, while some are essential for a
|
|
network to function correctly. Here are details of some of the important ICMP traffic that you should
|
|
know about, and consider allowing through your network.</p>
|
|
<br>
|
|
</div>
|
|
|
|
<div id="EchoReqReply">
|
|
<h4>Echo Request and Echo Reply<br>
|
|
<small>IPv4 - Echo Request (Type8, Code0) and Echo Reply (Type0, Code0)<br>
|
|
IPv6 - Echo Request (Type128, Code0) and Echo Reply (Type129, Code0)</small>
|
|
</h4>
|
|
<p>We all know these ones - ping is one of the first troubleshooting tools that we all learn. Yes, if
|
|
you enable it, it means that your host is now discoverable - but wasn't your web server already
|
|
listening on port 80 anyway? Sure, block this if you really want at your border to your DMZ, but
|
|
blocking ping traffic inside your network isn't going to get you much, except harder troubleshooting
|
|
("Can you ping your default gateway?", "No, but I never can, so that doesn't tell me anything!").</p>
|
|
<p>Remember you can also allow this with a given direction in mind; you could decide to let Echo
|
|
Requests out from your network to the Internet, and Echo Replies from the Internet to your network, but
|
|
not vice versa.</p>
|
|
<br>
|
|
</div>
|
|
|
|
<div id="FragNeed">
|
|
<h4>Fragmentation Needed (IPv4) / Packet Too Big (IPv6)<br>
|
|
<small>IPv4 - (Type3, Code4)<br>
|
|
IPv6 - (Type2, Code0)</small>
|
|
</h4>
|
|
<p>These ones are important. VERY important. They are an essential component in
|
|
<a href="http://en.wikipedia.org/wiki/Path_MTU_Discovery">Path MTU Discovery</a> (PMTUD), which is an
|
|
essential part of TCP that allows two hosts to adjust their
|
|
<a href="http://en.wikipedia.org/wiki/Maximum_segment_size">TCP Maximum Segment Size</a> (MSS) value to
|
|
one that will fit in the smallest
|
|
<a href="http://en.wikipedia.org/wiki/Maximum_transmission_unit">MTU</a> along the path of links
|
|
between the two hosts. If two hosts have a smaller MTU than their own local link on the path between
|
|
them, and have no means of discovering this, traffic gets silently black-holed; in other words, "you're
|
|
gonna have a bad time".</p>
|
|
<p>IPv4 packets with the
|
|
<a href="http://en.wikipedia.org/wiki/IPv4#Flags">DF bit</a> set (that's most of them!), or IPv6 packets
|
|
(remember there's no fragmentation by routers in IPv6), that are too large for a router to transmit
|
|
across an interface will result in that router dropping the packet, and generating a Fragmentation
|
|
Needed / Packet Too Big ICMP error back to the source, which also contains the MTU of the too-small
|
|
link. If this error cannot get through to the sender, then the sender will just interpret the lack of
|
|
ACKs from the receiver as congestion/loss and re-transmit, which of course will also get dropped. This
|
|
kind of behaviour is tough to troubleshoot because of course the TCP handshakes all work fine, as they
|
|
are small packets, but then the session appears to stall as soon as any bulk data transmission
|
|
occurs.</p>
|
|
<p><a href="https://www.ietf.org/rfc/rfc4821.txt">RFC 4821</a> was developed to help hosts get around
|
|
this problem using Packetization Layer Path MTU Discovery (PLPMTUD), which discovers the path MTU by
|
|
incrementally increasing the MSS to try to find a suitable value for the path. This removes the
|
|
dependency on ICMP, and is available in most OS network stacks, but is not as efficient as learning
|
|
directly what the maximum MTU should be. So please just allow these ICMP messages through in the first
|
|
place, okay?</p>
|
|
<br>
|
|
</div>
|
|
|
|
<div id="TimeExc">
|
|
<h4>Time Exceeded<br>
|
|
<small>IPv4 - (Type11, Code0)<br>
|
|
IPv6 - (Type3, Code0)</small>
|
|
</h4>
|
|
<p>Traceroute is a very useful tool for troubleshooting network connections between two hosts, detailing
|
|
each hop on the path. It does this by sending a packet with a TTL of 1 so that the first hop sends back
|
|
a Time Exceeded message (including its own source IP), then sending a packet with a TTL of 2, and so on,
|
|
to discover each hop on the path.</p>
|
|
<p>Remember when you've run it before, and you get a hop or two that can't be discovered in the middle
|
|
of your trace? Or even worse, you try to traceroute to a host and *every* hop can't be discovered.
|
|
Annoying, right? That's because the person running those routers (or your local firewall) decided to
|
|
block ICMP Time Exceeded messages. Don't be that guy, okay?</p>
|
|
<br>
|
|
</div>
|
|
|
|
<div id="NDP">
|
|
<h4>NDP and SLAAC (IPv6)<br>
|
|
<small>Router Solicitation (RS) (Type133, Code0)<br>
|
|
Router Advertisement (RA) (Type134, Code0)<br>
|
|
Neighbour Solicitation (NS) (Type135, Code0)<br>
|
|
Neighbour Advertisement (NA) (Type136, Code0)<br>
|
|
Redirect (Type137, Code0)</small>
|
|
</h4>
|
|
<p>While IPv4 used
|
|
<a href="http://en.wikipedia.org/wiki/Address_Resolution_Protocol">Address Resolution Protocol</a> (ARP)
|
|
for layer 2 to 3 mappings, IPv6 takes a different approach, in the form of
|
|
<a href="http://en.wikipedia.org/wiki/Neighbor_Discovery_Protocol">Neighbour Discovery Protocol</a>
|
|
(NDP). NDP provides many functions, including router discovery, prefix discovery, address resolution,
|
|
and many more besides. In addition to NDP,
|
|
<a href="http://en.wikipedia.org/wiki/IPv6_address#Stateless_address_autoconfiguration">StateLess Address AutoConfiguration</a>
|
|
(SLAAC) allows a host to be dynamically configured on the network, similar in concept to DHCP (although
|
|
DHCPv6 does exist for finer-grained control).</p>
|
|
<p>These five ICMP types should be permitted within your network (not across your border) in order for
|
|
these features of IPv6 to function correctly.</p>
|
|
<br>
|
|
</div>
|
|
|
|
<div id="RateLim">
|
|
<h4>A Word About Rate Limiting</h4>
|
|
<p>While ICMP messages like the ones covered on this page can be very useful, remember that generating
|
|
all of these messages takes CPU time on your routers, and generates traffic. Do you really expect that
|
|
you should be getting 1000 pings a second through your firewall in a normal situation? Would that be
|
|
considered legitimate traffic if you saw it? Nope, probably not. Rate limit all of these ICMP traffic
|
|
types as you see fit for your network; it's a good line of defence that should not be ignored.</p>
|
|
<br>
|
|
</div>
|
|
|
|
<div id="Read">
|
|
<h4>Read, Research, Understand</h4>
|
|
<p>Given that the "to block or not to block" discussion for ICMP seems to always result in confusion,
|
|
anger, and borderline fanatical disagreements, go ahead and read up on the topic yourself. Spend time
|
|
understanding it as fully as you can; there are plenty of links throughout this page alone. Then you
|
|
can form your own opinion and make an informed choice about what is best for your network.</p>
|
|
<br>
|
|
</div>
|
|
|
|
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
|
|
<!-- Ad unit 1 -->
|
|
<ins class="adsbygoogle"
|
|
style="display:block"
|
|
data-ad-client="ca-pub-9437274436336633"
|
|
data-ad-slot="2850814504"
|
|
data-ad-format="auto"></ins>
|
|
<script>
|
|
(adsbygoogle = window.adsbygoogle || []).push({});
|
|
</script>
|
|
<br><br><br>
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<script>
|
|
(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
|
|
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
|
|
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
|
|
})(window,document,'script','//www.google-analytics.com/analytics.js','ga');
|
|
|
|
ga('create', 'UA-63980523-1', 'auto');
|
|
ga('send', 'pageview');
|
|
|
|
</script>
|
|
</body>
|
|
</html>
|