ICMP unreachables

From: some josher (no@email.address)
Date: 06/04/02 

From: some josher <no@email.address>
Date: Tue, 04 Jun 2002 03:32:37 GMT

The following lines are taken from /usr/src/sys/netinet/ip_icmp.h from
the OpenBSD 3.0 sources to clarify my

questions.

#define ICMP_UNREACH 3 /* dest unreachable, codes: */
#define ICMP_UNREACH_PORT 3 /* bad port */
#define ICMP_UNREACH_FILTER_PROHIB 13 /* prohibited access */

When writing firewall rules for my OpenBSD box I noticed that deny rules
which are written to return an

ICMP_UNREACH send an ICMP_UNREACH_PORT by default.
eg. block return-icmp in log quick proto udp from any to any

When should the ICMP_UNREACH_FILTER_PROHIB code be used? By it's name it
seems to be a logical code to send back

to denied connection attempts.

I've been told by a friend to send an ICMP_UNREACH to denied TCP
connection attempts instead of sending a TCP RST.

Is this a good idea? Why?

And one last question, when is it better to reply to attempted
connections with an ICMP_UNREACH or TCP RST rather

than just drop them silently?

cheers,
      josh

Relevant Pages

  • ICMP unreachables
    ... When writing firewall rules for my OpenBSD box I noticed that deny rules ... connection attempts instead of sending a TCP RST. ...
    (comp.security.firewalls)
  • rdr with pf and proxying (newbie question)
    ... this is how my network is arranged: ... I have the following interfaces on OpenBSD: ... dc0 (connection between OpenBSD and Linksys router) IP is 192.168.1.1 ... I have internet on the OpenBSD box. ...
    (comp.unix.bsd.openbsd.misc)
  • Re: Unexpected termination of http connections through nat.
    ... We are now running succesfully an OpenBSD firewall in this department for over a year. ... This URI will wget fine in a shell on the OpenBSD machine itself, as well as any other machine on the internet I tried, the connection will only terminated if the traffic is routet through this OpenBSD-NAT. ... I don't have any insight into it's configuration, but even if so, why does it make a difference if the connection is NATed or not NATed here... ...
    (comp.unix.bsd.openbsd.misc)
  • Unexpected termination of http connections through nat.
    ... This URI will wget fine in a shell on the OpenBSD machine itself, as well as any other machine on the internet I tried, the connection will only terminated if the traffic is routet through this OpenBSD-NAT. ... I don't have any insight into it's configuration, but even if so, why does it make a difference if the connection is NATed or not NATed here... ...
    (comp.unix.bsd.openbsd.misc)
  • no route to host from the 3rd NIC
    ... I have added a 3rd NIC to my openBSD 3.7 firewwall to connect it to a ... MS ISA server box, I have used a crossover cable to connect two NICs ... from ISA server which means the physical connection ...
    (comp.unix.bsd.openbsd.misc)
Loading