ICMP Filtering

• The following 4 ICMP message types need to pass through the firewall:

• Source Quench

• Parameter Problem

• Incoming Destination Unreachable - all sub-types

• Outgoing Destination Unreachable - sub-type Fragmentation Needed

• The following 4 ICMP message types can optionally pass through the firewall:

• Other Destination Unreachable sub-types (Port Unreachable is used by traceroute)

• Time Exceeded (traceroute)

• Echo Request

• Echo Reply

• Redirect should be allowed from your router only. (Drop them.)

Notes: