8

This question is slightly related to "Why Block Port 22 Outbound?". I don't see how this can be a notable security risk.

1
  • Blocking outbound ICMP will block trace route etc., so it will impede network diagnostics.
    – Richard
    Aug 19, 2009 at 9:49

6 Answers 6

7

Blocking ICMP outbound and ALL other connections from your environment is a good start for building your firewall/security policy.

But there are a lot of things that you should know before hand and take into account. A good example is when blocking all ICMP packets while allowing some other protocols such as tcp port 80 (http) could lead to problems with MTU/PMTU. If you have a network connection that uses an encapsulation such as pppoe, GRE, or one of the many others you WILL run into a large number of hard to identify MTU issues.

Good area to start reading is:

2
  • +1 for mentioning Path MTU Discovery. Aug 19, 2009 at 4:25
  • 4
    This ignores answering the real question ("why?") by simply stating that it's "a good start". Furthermore, linked "IMCP stands for trouble" is 404-ing, so that's of no use.
    – ironsam
    Feb 23, 2012 at 18:28
8

Security is frequently thought about in a "blacklist everything, whitelist whats needed" context, aft to a tinfoil hat level of limiting outbound connections until someone complains. While its easy to ask "why block" .. a security expert will ask "why do you need" ... This is why a corporate network is very restrictive (blacklist first) vs a standard home network (whitelist everything outgoing).

A machine on your network running on a botnet providing bandwidth for ICMP PING saturation of a host is one realistic scenario.

4

These icmp dos attacks were useful 10 years ago. Nobody will use them now and this is stupid thing to filter all icmp packets. Books that suggest to block all icmp packets are 1) written by stupid people or 2) written by people to make your network hard for diagnostics and to make you call a company that will fix it for you :)

even icmp redirect messages are not harmful if you have only static routes...

so please don't advise people to disable the main diagnostic protocol of the internet

3

I think this is not a big deal but this can be considered as a practice used in "default deny policy" used in systems administration. The reason for blocking ICMP would be avoiding ICMP DOS attacks against another host. (To be ethical)

ICMP Attacks

Cisco Vulnerable to ICMP DoS

5
  • +1 ICMP DOS attacks were a big deal not too long ago.
    – Doug Luxem
    Aug 19, 2009 at 3:36
  • 2
    -1: Singling out ICMP here is not the correct method. TCP/UDP/ICMP and all the others IP Protocols (iana.org/assignments/protocol-numbers) can be used to create DoS attacks under the right conditions. What is really needed is correct filtering of acceptable packets for environment. Aug 19, 2009 at 4:24
  • +1 to even out inappropriate -1.
    – SirStan
    Aug 19, 2009 at 4:28
  • 2
    How ethical is it to ignore one of the core diagnostic protocols of the internet? ICMP is not the only internet protocol subject to abuse via DOS and other attacks (hint: they all are). google.com responds even opens up inbound ICMP for a reason: to support a core protocol and allow diagnostics.
    – ironsam
    Feb 23, 2012 at 18:41
  • ICMP attacks page seems to be down, link to the web archive: web.archive.org/web/20131005054532/http://www.javvin.com/… Aug 25, 2020 at 4:00
2

It's possible, for example, for a malicious piece of software on a compromised system to send messages "back home" via fake echo replies. This could give the remote listening system quite a bit of information that you don't necessarily want it to have, one little piece at a time. Anything the malware has access to could go right out the pipe.

2
  • In which case one needs to focus on removing the malware rather on the data it sends.
    – Richard
    Aug 19, 2009 at 9:48
  • 1
    In which case one needs to ALSO focus on removing the malware....
    – squillman
    Aug 19, 2009 at 11:14
2

Another reason to block outbound ICMP is to (attempt to) foil port scanners. Many firewalls will silently drop inbound packets denied by security policy (usually an ACL). However, if a packet is allowed through, and the destination application itself isn't running, most servers will return an ICMP Unreachable packet of some type. This difference in behavior for an unavailable port can give an attacker valuable insight into your network.

2
  • Security by Obscurity?
    – habakuk
    Jul 20, 2012 at 9:08
  • 1
    Obscurity is a poor security mechanism by itself, but it can be quite useful as part of a broader security strategy. Jul 23, 2012 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.