Re: IPFW and icmp

From: chip (chip.gwyn_at_gmail.com)
Date: 09/02/04

  • Next message: Peter Pentchev: "Re: IPFW and icmp"
    Date: Wed, 1 Sep 2004 23:57:38 -0400
    To: freebsd-security@freebsd.org
    
    

    On Wed, 1 Sep 2004 20:37:52 -0700 (PDT), Dave <mudman@metafocus.net> wrote:
    >
    > I'm not a master of the internet RFCs, but I do believe icmp messages have
    > different types.
    >
    > Now to enable traceroute for IPFW, I might put in a rule like this:
    >
    > ipfw add pass icmp from any to me
    >
    > However, how would I make a rule to limit icmp messages to just those used
    > by traceroute? Can the messages be distinguished as such?
    >
    > A dynamic rule that exists only for the duration of a traceroute execution
    > would be even better. I take it 'setup' or 'check-state' would follow in
    > that case?
    >

    Dave,

      I can't comment much on how to build the exact rules you need, but
    you should be made aware that different implementations of traceroute
    achieve the results in different ways. Cisco routers and most *nix
    boxen use UDP packets while Microsoft stuff uses ICMP. A good guide
    to the difference:

    http://www.cisco.com/warp/public/105/traceroute.shtml

    >From a quick google search however, I find the following from:
    http://lists.freebsd.org/pipermail/freebsd-security/2004-February/001585.html

    # TRACEROUTE - Allow outgoing
    ${fwcmd} add pass udp from any to any 33434-33523 out via ${oif}

    Hope this helps!

    --chip

    -- 
    Just my $.02, your mileage may vary,  batteries not included, etc....
    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
    

  • Next message: Peter Pentchev: "Re: IPFW and icmp"

    Relevant Pages

    • Re: allowing icmp still doesnt allow traceroute
      ... >> 00600 allow icmp from any to any ... >> for ipfw, and i still get sendto Permission denied when ... >> I try to traceroute. ... You want to allow UDP packets in that above range ...
      (FreeBSD-Security)
    • IPFW and icmp
      ... I'm not a master of the internet RFCs, but I do believe icmp messages have ... Now to enable traceroute for IPFW, I might put in a rule like this: ...
      (FreeBSD-Security)
    • Re: disable traceroute to my host
      ... I don't know if it is posible with ipfw, but with ip filter you can add ... That will stop windows traceroute as well as unix traceroute ... Unix traceroute uses udp packets with destination port> 33434, ...
      (FreeBSD-Security)
    • Re: Stealth vs. Blocked
      ... try traceroute -v 12.34.56.78 ... it displays ICMP messages. ... (replace 'badnews' with 'news' in e-mail address) ...
      (alt.computer.security)
    • Re: Stealth vs. Blocked
      ... reading but still tells you squat. ... > try traceroute -v 12.34.56.78 ... > it displays ICMP messages. ... > Lars M. Hansen ...
      (alt.computer.security)