OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: deny incoming icmp
From: Manfredi Blasucci (sonoroinet.it)
Date: Thu Aug 17 2000 - 04:29:07 CDT

"Rashid N. Achilov" wrote:

>
> Sorry, more precision...
>
> I have a firewall, protecting my network. IPFIREWALL, IPFIREWALL_VERBOSE, IPFIREWALL_FORWARD
> enabled. What can I allow icmp from our network any deny/fake incoming to our network icmp?
> --

Try with those:

${fwcmd} add allow log icmp from any to $ip via $eth out
${fwcmd} add allow log icmp from any to $ip via $eth in icmp 0 <- Echo Reply
${fwcmd} add allow log icmp from any to $ip via $eth in icmp 3 <- Destination Unreachable
${fwcmd} add allow log icmp from any to $ip via $eth in icmp 8 <- Echo
${fwcmd} add allow log icmp from any to $ip via $eth in icmp 11 <- Time Exceded
${fwcmd} add allow log icmp from any to $ip via $eth in icmp 12 <- Parameter Problem

See also http://www.sys-security.com/archive/papers/ICMP_Scanning.pdf.

Bye,
Manf

To Unsubscribe: send mail to majordomoFreeBSD.org
with "unsubscribe freebsd-security" in the body of the message