4 ms·

Yeah, ICMP tunnelling is also a common bypass method for captive networks, so simply blocking all ICMP seems logical.

• EvanAnderson 1y ago
  Every time I've had to fight with path MTU discovery not working I've cursed the people who block all ICMP, though. If ICMP echo / echo-reply is the problem just block that. At the very least, allow destination unreachable / fragmentation needed thru (type 3, code 4).
  • pixl97 1y ago
    Most of the people blocking ICMP have no clue that ICMP codes/types even exist.
  • yardstick 1y ago
    I am sure someone will find a way to exfiltrate data using any ICMP type. How good are firewalls at validating the packets are legit?