> I've searched the mailing list archives, and the how-tos, and
> didn't find a clear answer to the question of "block everything,
> yet allow ping and traceroute to the box to work". In short,
> I have:
>
> block in all
> block out all
>
> #---now we deal with ICMP packets
> #---let ping work
> pass in log quick on hme0 proto icmp from any to any icmp-type echo
> pass in log quick on hme0 proto icmp from any to any icmp-type echorep
> #---let traceroute work
> pass in log quick on hme0 proto icmp from any to any icmp-type 0
> pass in log quick on hme0 proto icmp from any to any icmp-type 11
>
> The ping part works, but not traceroute. Help...
Some "traceroute" programs probe with ICMPs but some probe
with UDP packets. You are probably trying to use one of the
latter.
> Also, in searching the keywords for icmp-type, I noticed "squench".
> Shouldn't that be either "squelch" or "quench"? Is this a new word?
An abbreviation of two words: "Source Quench".
--
David Pick
