I see on this question (How can I stop Linux from sending ICMP "Destination Unreachable" responses?) that there was a lot of discussion pointing to the fact that you shouldn't turn off ICMP unreachable messages. I am wondering why and when you should? I too want to know how to do it. I know it breaks MTU path discovery but what else?
On cisco devices you can turn this on and off, there must be a reason. In their documentation it just says that turning it off is supposed to be for increased security as in it's harder to get information about your network? This is what the cisco documentation says. I need to implement the ability to turn this on and off on a switch for my company so I am learning about it. Regardless of the why's I still have to do it, but I'd like an informed answer on why to do it or not to give to others.
When I want to turn off ICMP redirects I do this:
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
Is there something similar for unreachables?
The user on the other thread did it like so:
iptables -A OUTPUT -p icmp --icmp-type destination-unreachable -j DROP
is this a good way, then i could turn it on again by stopping this drop?
Should I be telling people that they don't need this feature?
EDIT: Online I see this:
An attacker could gather information’s about your network when scanning it, like unused IP’s and networks. When working with (interface-) Access-Lists, a deny statement triggers an ICMP Type 3 Code 9/10 message (Network/Host is Administratively Prohibited). When disabling ICMP unreachables on the interface where the ACL is applied, the deny statement acts like a ‘drop’ and does not reply.