0

Is it ok for me to drop all types of ICMP packets? I.e. iptables -I INPUT -p icmp -j DROP.

Everything except one service seems to work. I already stopped this service. To be specific I functioned as non-exit Tor relay and that seems to have stopped working. In 2 days I dropped 107K ICMP packets, which seems excessive to me, isn't that so? Note, that I run some other services (on open ports) like Bitcoin.

1 Answer 1

5

No, it's not OK. ICMP exists for a reason. For example, if you drop all ICMP packets you will not be able to communicate via IP with any host where the route to it is such your machine needs to be told to fragment the packets it's sending. At the very least look at the ICMP type and only drop those that you know are not needed.

This has been described on the other StackExchange sites (in descending order of cluefulness):

(also https://networkengineering.stackexchange.com/questions/2103/should-ipv4-icmp-from-untrusted-interfaces-be-blocked but there's only one answer and it admits some bias. It's probably standard knowledge e.g. in professional certifications so it doesn't tend to come up on the professional networking site).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .