Matthew Sanderson wrote:
>
> Isn't this an Evil Thing To Do? What ICMP traffic is safe to block, an
> what isn't?
If you want an easy way to set up these rules, see this:
http://www.babel.com.au/phpfwgen/
Here's my list:
IPCHAINS='/sbin/ipchains'
ALL='0.0.0.0/0'
$IPCHAINS -A input -p icmp -s $ALL echo-reply -d $ALL -j ACCEPT
$IPCHAINS -A input -p icmp -s $ALL destination-unreachable -d $ALL -j ACCEPT
$IPCHAINS -A input -p icmp -s $ALL network-unreachable -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL host-unreachable -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL protocol-unreachable -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL port-unreachable -d $ALL -j ACCEPT
$IPCHAINS -A input -p icmp -s $ALL source-route-failed -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL network-unknown -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL host-unknown -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL network-prohibited -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL host-prohibited -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL TOS-network-unreachable -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL TOS-host-unreachable -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL communication-prohibited -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL echo-request -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL time-exceeded -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL ttl-zero-during-transit -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL ttl-zero-during-reassembly -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL parameter-problem -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL ip-header-bad -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL required-option-missing -d $ALL -j ACCEPT -l
$IPCHAINS -A input -p icmp -s $ALL -d $ALL -j DENY -l
--
----+------------------------+--------------------------
Del | mailto:[EMAIL PROTECTED] | Christchurch, New Zealand
----+------------------------+--------------------------
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
