Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question was inspired by this answer which states in part:

The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP).

But, is it truly a good practice for a firewall to allow ICMP? What are the security implications, and are there cases where ICMP should be turned off?

share|improve this question
1  
I'm sure there are plenty of other reasons, but for one - it makes remote administration a nightmare. –  Terry Chia Oct 17 '12 at 2:25
2  
It's one of those "Unless you're a networking god and really know what you're doing, don't mess with it" sort of things. –  Chris S Oct 17 '12 at 3:23
1  
IMO, this rule applies to the entire firewall, not just ICMP. –  Simon Richter Oct 17 '12 at 5:48
1  
See also: Stop Breaking the Internet! –  tylerl Nov 20 '12 at 7:02
    
RFC 4890 : ietf.org/rfc/rfc4890.txt and this draft RFC: datatracker.ietf.org/doc/draft-ietf-opsec-icmp-filtering/… ... both provide detailed advice on how to filter both ICMPv4 and ICMPv6 packets. –  TimSmall Apr 29 at 11:41

2 Answers 2

up vote 54 down vote accepted

Compared to other IP protocols ICMP is fairly small, but it does serve a large number of disparate functions. At its core ICMP was designed as the debugging, troubleshooting, and error reporting mechanism for IP. This makes it insanely valuable so a lot of thought needs to into shutting it down. It would be a bit like tacking >/dev/null 2>&1 to the end of all your cron entries.

Most of the time when I talk to people about blocking ICMP they're really talking about ping and traceroute. This translates into 3 types

  1. 0 - Echo Reply (ping response)
  2. 8 - Echo Request (ping request)
  3. 11 - Time Exceeded

That's 3 types out of 16. Let's look at a couple of the other ICMP type that are available.

  • 4 - Source Quench (send by a router to ask a host to slow down its transmissions)
  • 3 - Destination Unreachable (consists of 16 different kinds of messages ranging from reporting a fragmentation problem up to a firewall reporting that a port is closed)

Both of which can be invaluable for keeping non-malicious hosts operating properly on a network. In fact there are two (probably more but these are the most obvious to me) very good cases where you don't want to restrict ICMP.

  1. Path MTU Discovery - We use a combination of the Don't Fragment flag and type 3 code 4 (Destination Unreachable - Fragmentation required, and DF flag set) to determine the smallest MTU on the path between the hosts. This way we avoid fragmentation during the transmission.
  2. Active Directory requires clients ping the domain controllers in order to pull down GPOs. They use ping to determine the "closest" controller and if none respond, then it is assumed that none are close enough. So the policy update doesn't happen.

That's not to say that we should necessarily leave everything open for all the world to see. Reconnaissance is possible with ICMP and that is generally the reason given for blocking. One can use pings to determine if a host is actually on, or Time Exceededs (as part of a traceroute) to map out network architectures, or Rory forbid a Redirect (type 5 code 0) to change the default route of a host.

Given all that, my advice is, as always, take a measured and thoughtful approach to your protections. Blocking ICMP in its entirety is probably not the best idea, but picking and choosing what you block and to/from where probably will get you what you want.

share|improve this answer
5  
Nicely detailed –  Lucas Kauffman Oct 17 '12 at 4:55
8  
small detail: While ICMP is optional in IPv4, it is required by IPv6 to operate normally. The role of ICMP has changed a lot. Lightweight read about it: blogs.cisco.com/security/icmp-and-security-in-ipv6 –  Mike Oct 17 '12 at 7:43
    
@Mike Oh sure, I guess I wasn't clear but I was specifically talking about v4. IPv6 is a different enough beast that we really need to treat it as completely different protocol when designing and protecting v6 networks. –  Scott Pack Oct 17 '12 at 11:38
4  
+1 "... or Rory forbid..." I Actually laughed out loud. –  tylerl Oct 18 '12 at 2:08
    
@tylerl: I laughed writing it too. Granted I had had some wine and it was 1.5 hours past my bedtime. –  Scott Pack Oct 18 '12 at 2:14

ICMP exists for a reason, and not all of that reason is ping. It's the "meta" protocol that is used to communicate control messages about the network itself. Have a look at ICMP on Wikipedia to get a better idea of what it is and what it's for.

Other ICMP messages also include destination host unreachable, fragmentation required, congestion control, TTL exceeded, IP protocol errors, and an number of others.

The network will operate without ICMP--resilience in the face of packet drops is one of IP's core strengths--but it will operate more slowly, less efficiently, and without the benefit of these signals to help you diagnose and solve problems.

Security issues with ICMP tend to be the more nebulous "information disclosure" issues. E.g. If your router sends an ICMP message back to someone, then that someone knows you have a router. Maybe the attacker knowing you have a router is something you're worried about, or more likely it's not. But security research tends to err on the side of silence just to be on the safe side, just in case.

Occasionally there's an ICMP related "ping of death" style vulnerability in an OS. Currently none exist in any mainstream OSes. But once again, security advocates err on the side of caution, just in case.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.