If I configure an Amazon AWS VPC, should I explicitly allow ICMP "destination unreachable" packets inbound? I am wanting the VPC firewall to block everything by default, however does this mean this (potentially) breaks things for DSL traffic? Does the stateful firewall let these packets back in, whereas the ACLs used on VPC subnets, because it is stateless, does not?
I suppose my main question is why isn't this a default rule if it is safe? - Mark's current answer says ICMPTX is not a real threat on a network that you have control of.
In Thomas Pornin's answer on Security risk of PING he states:
Some ICMP packet types MUST NOT be blocked, in particular the "destination unreachable" ICMP message, because blocking that one breaks path MTU discovery, symptoms being that DSL users (behind a PPPoE layer which restricts MTU to 1492 bytes) cannot access Web sites which block those packets (unless they use the Web proxy provided by their ISP).
How likely are the default rules to break things if blocking ICMP "destination unreachable" as Thomas points out? Should time and effort be spent to explicitly allow these on each VPC and subnet firewall and ACL rule?
There are a few common causes for not being able to get the ICMP replies necessary for PMTUD [Path MTU Discovery] to work. Overzealous network administrators will configure their firewalls to drop all ICMP since certain ICMP messages are considered security threats. Routers are sometimes (mis) configured with PMTUD disabled and so will simply drop the packet without sending the required ICMP message.
If ICMP blocking is so common on AWS and other cloud and non cloud hosting providers, why do we not see more black hole problems? If it is not a widespread problem, and many people are on DSL using PPoE it seems sensible to leave it blocked as the default.