安全基础系列之状态检测工作机制

#define ICMP_ECHOREPLY        0    /* Echo Reply            */

Needed if you want to allow ping, so you can allow that for trusted peers
outgoing and incoming for all to allow them to ping the internet

#define ICMP_DEST_UNREACH    3    /* Destination Unreachable    */

Some Sub Types are needed in and out, see below

#define ICMP_SOURCE_QUENCH    4    /* Source Quench        */

Allow it outbound anyway, inbound is less likely to be a problem, unless you
are doing some streaming or multicast feeding to the internet.

#define ICMP_REDIRECT        5    /* Redirect (change route)    */

block!

#define ICMP_ECHO        8    /* Echo Request            */

you might allow it incoming for trusted addresses (note some NICs will
require you to make your primary DNS Server pingable!)

#define ICMP_TIME_EXCEEDED    11    /* Time Exceeded        */

helpfull if you allow it incoming, could allow exploring your network if you
allow it outbound.

#define ICMP_PARAMETERPROB    12    /* Parameter Problem        */

helpfull if you allow it incoming, could allow exploring your network if you
allow it outbound.

#define ICMP_TIMESTAMP        13    /* Timestamp Request        */
#define ICMP_TIMESTAMPREPLY    14    /* Timestamp Reply        */
#define ICMP_INFO_REQUEST    15    /* Information Request        */
#define ICMP_INFO_REPLY        16    /* Information Reply        */
#define ICMP_ADDRESS        17    /* Address Mask Request        */
#define ICMP_ADDRESSREPLY    18    /* Address Mask Reply        */

Block those on the external interface


/* Codes for UNREACH. */
#define ICMP_NET_UNREACH    0    /* Network Unreachable        */

ignored, so block it

#define ICMP_HOST_UNREACH    1    /* Host Unreachable        */

allow it at least inbound, best would be if you can do that stateful

#define ICMP_PROT_UNREACH    2    /* Protocol Unreachable        */

you can block that

#define ICMP_PORT_UNREACH    3    /* Port Unreachable        */

you should allow that at least inbound. Be aware that some filter rules
should send PORT_UNREACH on connection request (at least 137,139 and auth),
so make sure not to block those ICMP packetes which are generated by your
reject rule.

#define ICMP_FRAG_NEEDED    4    /* Fragmentation Needed/DF set    */

Allow it in, and possible out if you have different MTUs inside your
network.

#define ICMP_SR_FAILED        5    /* Source Route failed        */

Not strictly needed. Nobody should asume SR works anywhere, anyway.

#define ICMP_NET_UNKNOWN    6

block, its ignored

#define ICMP_HOST_UNKNOWN    7

allow it at least inbound.

#define ICMP_HOST_ISOLATED    8

block.

#define ICMP_NET_ANO        9
#define ICMP_HOST_ANO        10

those are the new types returned by ipfilters. You may let them pass in and
out.

#define ICMP_NET_UNR_TOS    11
#define ICMP_HOST_UNR_TOS    12

block

#define ICMP_PKT_FILTERED    13    /* Packet filtered */

block, depricated

#define ICMP_PREC_VIOLATION    14    /* Precedence violation */
#define ICMP_PREC_CUTOFF    15    /* Precedence cut off */

block.