In a way yes, but I think the issue is largely caused by those up the chain that make it hard to deal with. Doing a search on should I block ICMP, or what ICMP

In a way yes, but I think the issue is largely caused by those up the chain that make it hard to deal with. Doing a search on should I block ICMP, or what ICMP to block, answers are: [1] No!!; some security issues; a lot of ICMP should be blocked; suggests further research [2] you should selectively filter; example iptables rule to allow echo; assess evaluate and make your own rules [3] listing of types and RFC recommendations for transit and local traffic So I guess I should take "Should Be Dropped" and "Policy Should be Defined" from [3] and plug them into [2]. Why is it so hard? Why isn't the answer: "No, defaults are safe, no need to block anything", or "Select one of: Endpoint / Site firewall / Internet router; customize if needed"? IMO, this is a mess. This is the ultimate cause of all the sewage, time spent both debugging, and even more on learning what and how to block, configuring it all. Issues like this even hinder IPv6 adoption, because who is going to deal with all the complexity. [1] http://shouldiblockicmp.com/ http://shouldiblockicmp.com/ [2] https://blog.securityevaluators.com/icmp-the-good-the-bad-and-the-ugly-130413e56030 https://blog.securityevaluators.com/icmp-the-good-the-bad-an... [3] https://serverfault.com/questions/981558/which-ipv4-6-icmp-types-should-i-drop-to-block-ping https://serverfault.com/questions/981558/which-ipv4-6-icmp-t...