6 ms·
Should I Block ICMP?
- deleted 1y ago[deleted]
- TacticalCoder 1y ago[dead]
- appleaday1 1y agoIts like me blocking youtube on hosts file or even on Pihole or related manually. I realize blocking youtube BREAKS a lot of things in the network.
- Retr0id 1y agoWhat does blocking youtube break, aside from youtube?
- gavinsyancey 1y agoThere's a YouTube domain that's somehow a load-bearing part of Google's OAuth login flow.
- cj 1y agoI’ve never understood this (and really would like to). Why on earth does Google redirect to YouTube and then back to Google when logging in… The only reason I can think of is to sync user session cookies across domains?
- jcelerier 1y agoI guess it's the same reason I go through 4 login screens whenever I want to login to my Microsoft account... Legacy
- UltraSane 1y agoPerhaps they want to force companies to not block YouTube.
- kaoD 1y agoIt's indeed to log you in to multiple Google properties at once. It's not needed for e.g. Gmail (since it's a subdomain under google.com) but YouTube is in its own domain so it has no access to google.com's cookies.
- odo1242 1y agoI can confirm: it’s because of the syncing session cookies across domains. I do believe it works if you block just the youtube.com domain and not *.youtube.com
- j16sdiz 1y agoYou already know the reason. In additional to youtube.com, in many cases, they redirect to many countries specific domain as well (e.g google.co.jp) Youtube is common enough that they want to login on the same flow
- kccqzy 1y agoI turned off YouTube for my account using admin.google.com. Doing so causes Google to stop redirecting me to YouTube and back. Of course this also means I'm never logged in while visiting YouTube.
- timewizard 1y agoOther than Chrome browsers don't support third party cookies by default.
- prirai 1y agoYes, I noticed this. Perhaps due to different handling of logins on both the sites. This could be handled in the backend by not redirecting as well, but therd should have been design choices there.
- _7acn 1y agoYes
- taikahessu 1y agoShould I block port 80?
- aleph_minus_one 1y agoYes. And port 443, too.
- Sohcahtoa82 1y agoYou people jest, but I once worked under a CISO that started an initiative to close all ports on production systems. Yes, including 80 and 443. He was purely a GRC monkey that had absolutely zero technical knowledge, he just knew how to check boxes. It took way too long for me to explain to him that closing those ports would take our SaaS down entirely, and I was absolutely appalled that I had to have that discussion and started questioning how the hell this guy became a CISO. I've heard some people argue that CISOs don't need to be technical, but I wholeheartedly disagree and can't fathom how anybody could think that someone who manages something should be able to get away with not having any knowledge in the field they manage. Like, I get that the IC track and the management track are completely different skillsets, but once you get to that level, you should have both sets of skills. I wouldn't want a CTO that doesn't know how to code, and I'd be terrified of a CFO that doesn't know accounting.
- wink 1y agoI mean I know people value your uptime, but isn't that simply a case of getting the order in writing, a quick CC'd email to the CEO and then putting the site offline as advertised? Some people just don't learn any other way.
- Sohcahtoa82 1y agoAh yes, malicious compliance. My favorite! The thing is, I wouldn't actually have the authority to make the change. I'd have to convince someone from DevOps/SRE to do it, and they were certainly not gonna do it.
- protocolture 1y agoISP: No you should definitely have ICMP available for testing. SAAS Engineer: Leave it on so I can tell when your shit goes down without having to consult your service status page. Sysadmin: I really dont care what you do, just enable it when you raise a complaint with your ISP so they can tell you what you broke. Residential: Your TP Link hyper dreadnought super hawk that is taking up every inch of the 5ghz indoor spectrum in your home is probably already blocking icmp for you. Its probably also already part of a botnet. YMMV.
- wahern 1y ago> Sysadmin: I really dont care what you do Dropping ICMP breaks path MTU discovery (PMTU). It's the biggest reason why sites break when accessed (or served) over VPNs. This is often mitigated on the server, or in NAT-ing routers, by clamping TCP MSS, but that doesn't really resolve the problem. It doesn't fix it for UDP, nor likely for double VPN scenarios, etc, plus you're just losing bandwidth that way. Some people make fatalistic arguments that even if they allow ICMP, something downstream may not have, so it's futile. But the networks in the middle rarely if ever block ICMP; those engineers know better. The real issue is on the ends. If you're a sysadmin dropping ICMP, you're half the problem. Fix ICMP on your end, and half the problem goes away. The other half of the problem are those NAT-ing routers, firewalls, and VPNs that don't handle ICMP properly. You can't fix those, but plenty of residential and commercial equipment on the other end, as well as VPN setups, actually do the right thing. Don't make perfect the enemy of better.
- protocolture 1y agoYou are absolutely correct, but also, I am already having to clamp MTU for most business customers anyway, for a hundred reasons. The issue is that sysadmins make this the ISP's issue anyway. They wont do any kind of investigation but simply yell at the telco. Telcos are ready willing and able to clamp. Its as natural as breathing at this point. The only thing that gets me is when the some small business refuses to enable ICMP for troubleshooting when they raise a complaint. You have to come to the table at least that far.
- guyzero 1y agoshouldiimplementssl.com
- branon 1y agoThe explanation I've seen before is that it doesn't really matter for websites that don't _want_ anything from you. No credentials, no login forms, no text entry fields. Maybe there are edge cases associated with this?
- AStonesThrow 1y agoRemember the C-I-A triad of security. I consider the integrity of messages to-and-from the web to be very important. Many of us lived through days when ISPs or some other greedy middleman injected ads into unsecured web pages. They played DNS tricks too. Imagine if you had an app download that could be maliciously modified in-flight. Furthermore, a certificate can guarantee you’re not connected to an imposter. What if the TFA link was redirected to “abevigoda.com”? Catastrophe!
- justin_oaks 1y agoWithout TLS, sometimes still referred to as SSL, a webite's content can be modified by anyone controlling the network path. This includes ISPs and WiFi operators. Sure, your website may have unimportant stuff on it that nobody relies on, but do you want visitors to see ads in your content that you didn't put there?
- baby_souffle 1y ago> The explanation I've seen before is that it doesn't really matter for websites that don't _want_ anything from you. No credentials, no login forms, no text entry fields. Still worth creating a bit of a shield between you and the site to make it just hat much harder for anybody in the middle to inject anything / change anything. Back before Lets Encrypt made it inexcusable to not have https, it was a common-ish prank to MITM all the HTTP traffic you could see and do something harmless like rotate images 180 degrees.
- 1y ago
- IAmNotACellist 1y agoThat's why I only use urinals with dividers, to block ICUP
- rfl890 1y agoClicked expecting a fat "NO", wasn't even surprised when I saw it.
- vaxman 1y agoYou aren't wrong..'nd I wrote one of the first Ethernet drivers (for any platform) almost half a century ago and spent a long time at the company that invented twisted pair Ethernet; but sharing MY insight gets me downvoted unless it aligns with pop views and is phrased so as not to amuse or confuse... If they're going to "Ask HN", they should ask something like "what are most others doing in regards to X" because that's the only information that can be accurately gleaned in this kind of environment; otherwise, consider asking Reddit/Gemini. https://youtu.be/V-SJQdREDKM https://youtu.be/V-SJQdREDKM
- rfl890 1y agoI don't understand. Did you RTFA? This isn't a person asking whether they should block ICMP, it's a webpage designed to answer that question. Unless you're just ranting about your poor experience on HN under my comment, in which case carry on, I couldn't care less.
- vaxman 1y agoThere is an ad at the bottom of your clickbait. I think you understand very well.
- rabbitofdeath 1y agothankfully its pingable ¯\_(ツ)_/¯ $ ping shouldiblockicmp.com PING shouldiblockicmp.com (52.92.225.139) 56(84) bytes of data. 64 bytes from s3-website-us-west-2.amazonaws.com (52.92.225.139): icmp_seq=1 ttl=241 time=75.3 ms
- eqvinox 1y agoNo IPv6 though. $ ping -6 shouldiblockicmp.com ping: shouldiblockicmp.com: Address family for hostname not supported
- BenjiWiebe 1y agoMaybe you should buy shouldiblockicmpv6.com...
- eqvinox 1y agoThe good thing about that is that I don't have to do that because if you blanket block ICMPv6, IPv6 just won't work at all. No neighbor discovery, no default route ;D
- truekonrads 1y agoPath MTU discovery lives off ICMP. Block ICMP and expect connections to fail.
- BLKNSLVR 1y agoI unapologetically block ICMP from sources I consider to be trash. Nothing worth keeping has broken as a result.
- eqvinox 1y agoIf you consider specific sources to be trash, why would you accept anything from them? Just block them completely…
- BLKNSLVR 1y agoYes, I block them completely, including ICMP. I also block outgoing to those sources (as destinations).
- Sohcahtoa82 1y agoThere's gotta be a term for what just happened in this thread, because it's something I've seen several times on HN. Person A makes a statement against X, Person B challenges the statement saying "if you're against X, why aren't you against Y?" when X is a subset of Y, then person A says "I'm against Y too" It just seems odd to me because the original statement against X is very specific, so it implies that they only dislike A. To give a simple example, imagine someone saying "I hate red Mazda Miatas" when the truth is that they hate red cars in general. It's just so odd and misleading to be so specific when the truth is far more general. I think the point I'm trying to make is...if you're blocking ALL traffic, including ICMP, from sources you consider trash, then why would you start the conversation with "I block ICMP"? Why go out of your way to create such a miscommunication? More importantly, how is your general viewpoint even relevant to a topic that's specifically about ICMP?
- eqvinox 1y agoI didn't follow up because one of those terms is "having autism". Or rather, I know a person who, understanding why this confuses/riles people, is putting active effort into not doing it, and is saying it's an aspect of autistic behavior for them. Of course autism is hugely variable, but context-related communication problems like this seem relatively common with high-functioning autism (where communication skills are close to the normie spectrum). Some people just do it to troll, though. It's rather silly, considering they're kneecapping their own communications, but… as with all trolls, non-engagement tends to be the best option. (So I'm non-engaging for 2 distinct reasons.)
- paulnpace 1y agoI don't know people focus on blocking protocols when IP addresses are more useful. I've blocked most of DO's IP address space and it really cleaned up the logs.
- chedabob 1y agoI wish I could block any IP that runs CPanel and Wordpress. Every time a server is hammering our corporate firewall, I know that if I put it into Shodan, it's going to be running out of date versions of those two. It's rare they come from the same IP block, so at best I can block a /32 if they're a persistent offender.
- isatty 1y agoNo, don’t block ICMP. Also, implement ssl because it’s trivial and prevents garbage isps from injecting ads. Third, how about no ads to begin with?
- bastard_op 1y agoBlocking ICMP tends to come with blocking ICMP Unreachables, that happens to handle Path MTU Discovery (PMTUD), which you definitely want on if you work around VPN's at all, or certain ISP's that might not allow a full 1500 byte frame. Microsoft loves to particularly set application traffic to Do-Not-Fragment, and this will play chaos on many Microsoft things if PMTUD is disabled around reduced MTU environments. It's best left on at least inside a private/protected network.
- toast0 1y agoEverybody sets traffic to Do-Not-Fragment. Nobody wants their routers to fragment packets anyway; you might as well ask to get a notification when too big packets are dropped. Nobody wants to have their servers reassemble fragments, it's too much work; many servers just drop any fragments they do get. I ran servers pushing 20 gbps of downloads, and would receive on the order of two fragments per second. It looked legitimate, so I preferred not to disable fragment assembly, but I'd set the reassembly buffer as small as possible; there's no need to keep more than say 16 fragments... if you're getting more than a handful of fragments, it's ddos and that one guy with a weird network will just have to deal. They probably can't use any other sites anyway.
- paffdragon 1y agoI am not a network engineer, but when I hear ICMP, I associate it with consuming CPU on my shitty router and DDos potential. I only block ICMP for unknown external traffic (response to packets not otherwise blocked by firewall, then aggressively rate limit that) and allow it internally. I used to go overboard in the past and learned how annoying it is to not being able to do a simple ping...
- eqvinox 1y agoIf people can send packets to you, they can DDoS your shitty plastic router CPU regardless of you blocking ICMP or not. And whether your router generates a reply is really ancillary to the question — so long as that reply isn't notably larger than the triggering packet. (Otherwise you're running a reflection amplifier and some people would like to have words with you.) These days with cheap bandwidth about, the only way to really prevent DDoS is to catch them at the source(s). Hell, I have 25Gbit at home (Init7), I can blow entire small telcos off the internet. Once. Then Init7 terminates my service. And that's really the only thing that can prevent this…
- paffdragon 1y agoFair enough. For me personally it's not that big of a concern. I just remember from a previous network monitoring gig that using ICMP had a few problems with rate limiting. But that wasn't my cheap router at stake. It's probably just something that stuck with me and not that relevant in my context anymore.
- mmis1000 1y agoBlock icmp don't even fix the cpu issue though, the router still use cpu to decide which packet should be blocked. If you really care about the cpu usage, you should drop raw traffic instead (when dos from certain ip is detected)
- paffdragon 1y agoIndeed. What I meant was that it's cheaper to drop than to generate a reply. But you are right, and I also mentioned in the other reply, that my router wouldn't stand a chance dropping or replying to a DDoS anyway, so probably this concern is not relevant in the home router context.
- deepsun 1y agoShould I block ICMPv6?
- DigitallyFidget 1y agoGenuine question here: what's the actual benefits of blocking icmp? Not asking "Why should I leave it on", I'm specifically asking for legitimate valid use cases for disabling it. I really can only think of one, abd that's if your server just gets a relentless amount of pings that it takes up a significant portion of your bandwidth. (There was a news article about a news site in Australia, I think, that had that happen)