4

This answer says there are a few ways of dealing with a blocked packet at a firewall:

At each of these levels a 1st IP packet (and any other protocol packet as an ESP or AH packet) might receive 4 types of treatment:

  1. the packet is simply dropped (not any form of reply)
  2. the packet is droped and an ICMP type 3, code 9 or 10 is returned,
  3. receive a TCP RST packet
  4. receive a TCP ACK packet

What is the difference between these choices, and when should I use them?

Improve this question

2 Answers 2

Reset to default
2

The difference is in the amount of information you provide to the sender of the packet.

  1. says, essentially: "No-one here. Your SYN packet went to nirvana." It provides the least amount of information to the other end. It also slows down attackers because they have to wait for a timeout.
  2. says: "Forbidden. There's someone here but they don't want to talk to you." It's the most helpful and polite response but may incite an attacker to try getting around the firewall.
  3. says: "Port closed. The target machine exists but the port is not in use." It is somewhat misleading and may hinder network troubleshooting, or incite an attacker to proceed probing other ports.
  4. says: "Port open. Will set up your connection." It doesn't make any sense to reply in that way to a blocked packet.

Which of these you choose is a matter of policy or personal preference. If you feel paranoid, choose #1. If you want to make the network administrators' job easier, choose #2. Personally I don't see much benefit in #3, and #4 is definitely out.

Improve this answer
1
  • If you want the sender to know you're explicitly blocking their traffic, ICMP type 3 code 13 means "Communication is administratively prohibited"
    – GLRoman
    Apr 20 at 23:33
1

Technically, the list of treatments is a bit longer (event if we consider only RFCs) - there's ICMP type 3, code 2 (protocol unreachable). There's ICMP type 3, code 4 (unreachable, fragmentation needed) when doing MTU path discovery. There's ICMP redirect (a bit esoteric, eh?).

Keep in mind that these days you'll be dealing with multi-layer firewalls/NGN firewalls/UTMs or whatever they're called today - their packet handling is advanced a little from the days of the days of the stateful firewall.

For example: consider the case of an anti-spam or e-mail firewall. Some of them behave more like a transparent proxy rather than a firewall. If you'd like to send an e-mail message via SMTP using your e-mail server, but a transparent firewall sits on the network and intercepts all e-mail messages. Before forwarding even a single packet out to your actual SMTP server, it would transparently accept the connection on behalf of your e-mail server, receive your e-mail in full, scan it, and if all is OK only then it will send it across. So you may think that the e-mail has been sent, but it could very well be that the anti-spam firewall has never relayed it to your intended destination.

IPS systems would break communication "mid-flight", in the moment that a violation is detected (based either on behavior or signatures). They may send a FIN, RST or may send nothing - just drop the packets.

In the modern sense of network security ... it's a bit more complicated than the 4 question's points. I would agree that in terms of stateful-only handling these are some of the main ways to do things.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .