On Mon, Dec 09, 2002 at 10:33:50AM -0300, Alejandro Valdez wrote:
>
> > Some people also like to block "proto icmp all with frag"
>
> This mean block all the icmp packets that have been fragmented?.
> Why should the firewall drop that packets?.
>
I suggested it only because I have seen other apparently
knowledgable people on this list post rules that include it.
Not sure of the specifics other than fragmented packets can be
used to do bad things to and behind firewalls. fragmented icmp
packets do seem to be an oddity. I added it to my ruleset, no
one has complained that anything is broken. I am blocking about
the same number of "icmp all with frag" as "all with short".
-steve
