Re: [Freeswitch-users] ICMP... and MTU
Sorry to ask, but .. If you dont recommend to block the ping, what do you recommend? and what issue cause the icmp block? Regards. On Tue, Feb 18, 2014 at 2:25 PM, Brian West <brian@freeswitch.org> wrote:
I want to open a discussion on this topic, I'm sure many of you fine freeswitchers have encountered the pain of exceeding the MTU and things not handling it properly. I've also see this mindset that blocking all ICMP will somehow make your network more secure, In doing this you're actually breaking PMTU and the internet in general. So check your firewalls, if you're blocking repent now and fix it... Input and discussions would be welcome on this topic.
I think this issue is more of an issue facing residential installs vs commercial installs... What have you seen?
-- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com
T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED)
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Call Send SMS Add to Skype You'll need Skype CreditFree via Skype
On Wed, 19 Feb 2014, Cesar Bermudez wrote:
Sorry to ask, but ..
There are no stupid questions - only stupid answers.
If you dont recommend to block the ping, what do you recommend? and what issue cause the icmp block?
You are most probably talking about ping and traceroute. But ICMP is a lot more than just that. The 3 types of ICMP you use for ping and traceroute are Echo Reply (type 0), Echo Request (type 8) and Time Exceeded (type 11). But there are many more such as Source Qunech and Destination unreachable. The question you should ask yourself: Why am I blocking this and what do I want to achieve? Many poeple are scared of ping of death but that has been patched many years ago and is not an issue as such. But if your thinking is that you would rather avoid any risk and can do without that very handy diagnostic tool then please do block for it. But that does still not mean that you should block for all ICMP. ICMP is Internet Control Message Protocol. Some very important stuff sometimes happens via ICMP. Like any other traffic you need to understand why/why not you want to block it. Yes - there may be errors in the implementation which makes your host blow up (vulnerable like Ping of death) but on the other hand the where create for a purpose. If you naively close for everything you must expect breakage as well. A good read is as usual wikipedia which shows you more uses for ICMP: http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol Security is never absolute. It is a question of convenience, usability and the amount of risk. If you can accept no risk the Internet is not for you. Kind Regards, Claus Andersen
On Wed, 19 Feb 2014, Claus Andersen wrote:
On Wed, 19 Feb 2014, Cesar Bermudez wrote:
Sorry to ask, but ..
There are no stupid questions - only stupid answers.
...and the pain of reading you own answer... I forgot to add the actual advice. If you would like to avoid breaking as much as possible but block the obvious dangerous stuff then you should block for ICMP redirect (type 5). That can be used for re-routing and should then actively be avoided. The rest is fairly benign. Personally I rarely block for ICMP echo. Ping is a very nice diagnostic tool. Some will argue that it can be used to find a attack vector (that is: confirm something is there). But mostly you are actively provding services from your host so that vector is easily found anyway. But as long as you understand the implications it is OK to block (or not). Kind Regards, Claus Andersen
Thx for your time and answers !!!! On Wed, Feb 19, 2014 at 10:39 AM, Claus Andersen <clan@wheel.dk> wrote:
On Wed, 19 Feb 2014, Claus Andersen wrote:
On Wed, 19 Feb 2014, Cesar Bermudez wrote:
Sorry to ask, but ..
There are no stupid questions - only stupid answers.
...and the pain of reading you own answer...
I forgot to add the actual advice. If you would like to avoid breaking as much as possible but block the obvious dangerous stuff then you should block for ICMP redirect (type 5). That can be used for re-routing and should then actively be avoided. The rest is fairly benign. Personally I rarely block for ICMP echo. Ping is a very nice diagnostic tool. Some will argue that it can be used to find a attack vector (that is: confirm something is there). But mostly you are actively provding services from your host so that vector is easily found anyway. But as long as you understand the implications it is OK to block (or not).
Kind Regards, Claus Andersen
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
ICMP redirect is to block carefully, I encountered a bunch of routers who used it extensively in HA configurations... for these, check the source to be your gateway ( arp sticked to be safe, with an admin mac set on the router iface to be sure it won't change in case of failover ) and you're good to go ! Le 19/02/2014 20:24, Cesar Bermudez a écrit :
Thx for your time and answers !!!!
On Wed, Feb 19, 2014 at 10:39 AM, Claus Andersen <clan@wheel.dk <mailto:clan@wheel.dk>> wrote:
On Wed, 19 Feb 2014, Claus Andersen wrote:
> On Wed, 19 Feb 2014, Cesar Bermudez wrote: > >> Sorry to ask, but .. > > There are no stupid questions - only stupid answers.
...and the pain of reading you own answer...
I forgot to add the actual advice. If you would like to avoid breaking as much as possible but block the obvious dangerous stuff then you should block for ICMP redirect (type 5). That can be used for re-routing and should then actively be avoided. The rest is fairly benign. Personally I rarely block for ICMP echo. Ping is a very nice diagnostic tool. Some will argue that it can be used to find a attack vector (that is: confirm something is there). But mostly you are actively provding services from your host so that vector is easily found anyway. But as long as you understand the implications it is OK to block (or not).
Kind Regards, Claus Andersen
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (3)
-
Cesar Bermudez
-
Claus Andersen
-
Tristan Mahé