4 ms·

> Of course, there was a misconfigured firewall that wouldn't fragment and wouldn't send "ICMP won't fragment". Blocked or dropped ICMP has caused me heartburn

> Of course, there was a misconfigured firewall that wouldn't fragment and wouldn't send "ICMP won't fragment". Blocked or dropped ICMP has caused me heartburn as well. I am pretty sure my co-workers are used to my "blocking ICMP is Evil Bad and Wrong" rants by now.

kureikain 5y ago
AWS blocked ICMP by default though and cause a lot of traceroute problem for me...
- est31 5y ago
  > If the maximum transmission unit (MTU) between hosts in your subnets is different, or your instances communicate with peers over the internet, you must add the following network ACL rule, both inbound and outbound. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#path_mtu_discovery https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network... If your instances communicate with peers over the internet. So by default, AWS was built to assume your instances do not communicate over the internet, lol.
temp667 5y ago
Some people don't want to deal with ping floods, sweeps, ICMP tunneling issued and the whole ICMP redirect attacks?
- korethr 5y ago
  There's a difference between blanket blocking all ICMP and selectively blocking or rate-limiting a subset of ICMP messages according to an accurate threat model for your various networks. The latter, properly done, is unlikely to break MTU discovery or your own ability to troubleshoot and monitor your own hosts/networks. The former is what makes network engineers want to eviscerate you and use your gut as patch cables.
  - labawi 5y ago
    IMO, the crux of the issue is that kind-of-necessary and dangerous functionality is commingled in "ICMP", with no trivial way to separate the two. With usual TCP and UDP, you block by default, allow outgoing, allow replies and your internet works (consumer defaults). If you want, you allow specific incoming ports and it's good enough for most use cases. It's almost trivial to configure a reasonable basic firewall, and you can learn all you need in 5-10 minutes. With ICMP, there is this long list of types and subtypes, some of which sound dangerous while others necessary. Which ones should you block and which ones should you allow? Do you expect everyone to create an accurate threat model? People have lives. So, some people end up blocking ICMP and internet "works" except .. of course it doesn't.
    - oarsinsync 5y ago
      > Do you expect everyone to create an accurate threat model? People have lives. So, some people end up blocking ICMP and internet "works" except .. of course it doesn't. This is the internet eqivalent of dumping your sewage in the lake because it's too difficult to deal with properly. People that do this externalise the costs of their choices onto everyone else, and it takes a bunch of specialists to identify what's happening and educate the problematic network operator, and/or clean up the mess.
      - labawi 5y ago
        In a way yes, but I think the issue is largely caused by those up the chain that make it hard to deal with. Doing a search on should I block ICMP, or what ICMP to block, answers are: [1] No!!; some security issues; a lot of ICMP should be blocked; suggests further research [2] you should selectively filter; example iptables rule to allow echo; assess evaluate and make your own rules [3] listing of types and RFC recommendations for transit and local traffic So I guess I should take "Should Be Dropped" and "Policy Should be Defined" from [3] and plug them into [2]. Why is it so hard? Why isn't the answer: "No, defaults are safe, no need to block anything", or "Select one of: Endpoint / Site firewall / Internet router; customize if needed"? IMO, this is a mess. This is the ultimate cause of all the sewage, time spent both debugging, and even more on learning what and how to block, configuring it all. Issues like this even hinder IPv6 adoption, because who is going to deal with all the complexity. [1] http://shouldiblockicmp.com/ http://shouldiblockicmp.com/ [2] https://blog.securityevaluators.com/icmp-the-good-the-bad-and-the-ugly-130413e56030 https://blog.securityevaluators.com/icmp-the-good-the-bad-an... [3] https://serverfault.com/questions/981558/which-ipv4-6-icmp-types-should-i-drop-to-block-ping https://serverfault.com/questions/981558/which-ipv4-6-icmp-t...

kureikain 5y ago

AWS blocked ICMP by default though and cause a lot of traceroute problem for me...

est31 5y ago
> If the maximum transmission unit (MTU) between hosts in your subnets is different, or your instances communicate with peers over the internet, you must add the following network ACL rule, both inbound and outbound. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#path_mtu_discovery https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network... If your instances communicate with peers over the internet. So by default, AWS was built to assume your instances do not communicate over the internet, lol.

temp667 5y ago

Some people don't want to deal with ping floods, sweeps, ICMP tunneling issued and the whole ICMP redirect attacks?

korethr 5y ago
There's a difference between blanket blocking all ICMP and selectively blocking or rate-limiting a subset of ICMP messages according to an accurate threat model for your various networks. The latter, properly done, is unlikely to break MTU discovery or your own ability to troubleshoot and monitor your own hosts/networks. The former is what makes network engineers want to eviscerate you and use your gut as patch cables.
- labawi 5y ago
  IMO, the crux of the issue is that kind-of-necessary and dangerous functionality is commingled in "ICMP", with no trivial way to separate the two. With usual TCP and UDP, you block by default, allow outgoing, allow replies and your internet works (consumer defaults). If you want, you allow specific incoming ports and it's good enough for most use cases. It's almost trivial to configure a reasonable basic firewall, and you can learn all you need in 5-10 minutes. With ICMP, there is this long list of types and subtypes, some of which sound dangerous while others necessary. Which ones should you block and which ones should you allow? Do you expect everyone to create an accurate threat model? People have lives. So, some people end up blocking ICMP and internet "works" except .. of course it doesn't.
  - oarsinsync 5y ago
    > Do you expect everyone to create an accurate threat model? People have lives. So, some people end up blocking ICMP and internet "works" except .. of course it doesn't. This is the internet eqivalent of dumping your sewage in the lake because it's too difficult to deal with properly. People that do this externalise the costs of their choices onto everyone else, and it takes a bunch of specialists to identify what's happening and educate the problematic network operator, and/or clean up the mess.
    - labawi 5y ago
      In a way yes, but I think the issue is largely caused by those up the chain that make it hard to deal with. Doing a search on should I block ICMP, or what ICMP to block, answers are: [1] No!!; some security issues; a lot of ICMP should be blocked; suggests further research [2] you should selectively filter; example iptables rule to allow echo; assess evaluate and make your own rules [3] listing of types and RFC recommendations for transit and local traffic So I guess I should take "Should Be Dropped" and "Policy Should be Defined" from [3] and plug them into [2]. Why is it so hard? Why isn't the answer: "No, defaults are safe, no need to block anything", or "Select one of: Endpoint / Site firewall / Internet router; customize if needed"? IMO, this is a mess. This is the ultimate cause of all the sewage, time spent both debugging, and even more on learning what and how to block, configuring it all. Issues like this even hinder IPv6 adoption, because who is going to deal with all the complexity. [1] http://shouldiblockicmp.com/ http://shouldiblockicmp.com/ [2] https://blog.securityevaluators.com/icmp-the-good-the-bad-and-the-ugly-130413e56030 https://blog.securityevaluators.com/icmp-the-good-the-bad-an... [3] https://serverfault.com/questions/981558/which-ipv4-6-icmp-types-should-i-drop-to-block-ping https://serverfault.com/questions/981558/which-ipv4-6-icmp-t...