Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question is slightly related to "Why Block Port 22 Outbound?". I don't see how this can be a notable security risk.

share|improve this question
    
Blocking outbound ICMP will block trace route etc., so it will impede network diagnostics. –  Richard Aug 19 '09 at 9:49
add comment

6 Answers

up vote 5 down vote accepted

Blocking ICMP outbound and ALL other connections from your environment is a good start for building your firewall/security policy.

But there are a lot of things that you should know before hand and take into account. A good example is when blocking all ICMP packets while allowing some other protocols such as tcp port 80 (http) could lead to problems with MTU/PMTU. If you have a network connection that uses an encapsulation such as pppoe, GRE, or one of the many others you WILL run into a large number of hard to identify MTU issues.

Good area to start reading is:

share|improve this answer
    
+1 for mentioning Path MTU Discovery. –  James Sneeringer Aug 19 '09 at 4:25
3  
This ignores answering the real question ("why?") by simply stating that it's "a good start". Furthermore, linked "IMCP stands for trouble" is 404-ing, so that's of no use. –  ironsam Feb 23 '12 at 18:28
add comment

Security is frequently thought about in a "blacklist everything, whitelist whats needed" context, aft to a tinfoil hat level of limiting outbound connections until someone complains. While its easy to ask "why block" .. a security expert will ask "why do you need" ... This is why a corporate network is very restrictive (blacklist first) vs a standard home network (whitelist everything outgoing).

A machine on your network running on a botnet providing bandwidth for ICMP PING saturation of a host is one realistic scenario.

share|improve this answer
add comment

I think this is not a big deal but this can be considered as a practice used in "default deny policy" used in systems administration. The reason for blocking ICMP would be avoiding ICMP DOS attacks against another host. (To be ethical)

ICMP Attacks

Cisco Vulnerable to ICMP DoS

share|improve this answer
    
+1 ICMP DOS attacks were a big deal not too long ago. –  Doug Luxem Aug 19 '09 at 3:36
2  
-1: Singling out ICMP here is not the correct method. TCP/UDP/ICMP and all the others IP Protocols (iana.org/assignments/protocol-numbers) can be used to create DoS attacks under the right conditions. What is really needed is correct filtering of acceptable packets for environment. –  Jeremy Rossi Aug 19 '09 at 4:24
    
+1 to even out inappropriate -1. –  SirStan Aug 19 '09 at 4:28
2  
How ethical is it to ignore one of the core diagnostic protocols of the internet? ICMP is not the only internet protocol subject to abuse via DOS and other attacks (hint: they all are). google.com responds even opens up inbound ICMP for a reason: to support a core protocol and allow diagnostics. –  ironsam Feb 23 '12 at 18:41
add comment

It's possible, for example, for a malicious piece of software on a compromised system to send messages "back home" via fake echo replies. This could give the remote listening system quite a bit of information that you don't necessarily want it to have, one little piece at a time. Anything the malware has access to could go right out the pipe.

share|improve this answer
    
In which case one needs to focus on removing the malware rather on the data it sends. –  Richard Aug 19 '09 at 9:48
1  
In which case one needs to ALSO focus on removing the malware.... –  squillman Aug 19 '09 at 11:14
add comment

Another reason to block outbound ICMP is to (attempt to) foil port scanners. Many firewalls will silently drop inbound packets denied by security policy (usually an ACL). However, if a packet is allowed through, and the destination application itself isn't running, most servers will return an ICMP Unreachable packet of some type. This difference in behavior for an unavailable port can give an attacker valuable insight into your network.

share|improve this answer
    
Security by Obscurity? –  habakuk Jul 20 '12 at 9:08
    
Obscurity is a poor security mechanism by itself, but it can be quite useful as part of a broader security strategy. –  James Sneeringer Jul 23 '12 at 13:45
add comment

These icmp dos attacks were useful 10 years ago. Nobody will use them now and this is stupid thing to filter all icmp packets. Books that suggest to block all icmp packets are 1) written by stupid people or 2) written by people to make your network hard for diagnostics and to make you call a company that will fix it for you :)

even icmp redirect messages are not harmful if you have only static routes...

so please don't advise people to disable the main diagnostic protocol of the internet

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.