4 ms·
So, what's the current recommendation on accepting public ICMP these days? There used to be some debate on the tradeoff between usefulness and security.
by imglorp 10y ago
So, what's the current recommendation on accepting public ICMP these days? There used to be some debate on the tradeoff between usefulness and security.
- kevin_b_er 10y agoFor IPv4, yes. ICMP is required to route ipv6 correctly.
- Arnt 10y agoIt's required for v4 too, if you want PMTU discovery to work.
- user5994461 10y ago> So, what's the current recommendation on accepting public ICMP these days? The recommendation is to accept ALL ICMP traffic, from everywhere, to everywhere, whatever it is. I've wasted too much time debugging tricky network issues because a dude thought that blocking ICMP was a great idea.
- jlgaddis 10y agohttp://shouldidisableicmp.com http://shouldidisableicmp.com ICMP types 3 and 4 should always be allowed. At your discretion, you may allow other types as well. Inbound, I allow types 0, 3, 4, 8, and 11, but I'm a network engineer. A paranoid security guy may prefer to block some of those.