Date: Wed, 28 Jun 2000 11:28:46 -0600 (MDT) From: Paul Hart <hart@iserver.com> To: Fernando Schapachnik <fpscha@via-net-works.net.ar> Cc: freebsd-security@FreeBSD.ORG Subject: Re: icmp type 3 code 4: a couple of questions Message-ID: <Pine.BSF.4.21.0006281114550.31913-100000@anchovy.orem.iserver.com> In-Reply-To: <200006281303.KAA02473@ns1.via-net-works.net.ar>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 28 Jun 2000, Fernando Schapachnik wrote:
> > pass out quick on fxp0 proto tcp from any to any keep state
> > pass out quick on fxp0 proto udp from any to any keep state
> > pass out quick on fxp0 proto icmp from any to any keep state
>
> You will also need (al least in 3.4-RELEASE):
>
> pass in quick on fxp0 proto icmp from any to any icmp-type 11
>
> to let traceroute work.
No, not in my experience. Try it without your explicit rule to allow ICMP
type 11 packets back in as it does work for me without your rule.
I had the same concern about how the ICMP time exceeded packets would make
their way back in. Darren Reed kindly commented on how the state tracking
code in IP Filter handles this case. See:
http://false.net/ipfilter/2000_06/0234.html
http://false.net/ipfilter/2000_06/0235.html
Paul Hart
--
Paul Robert Hart ><8> ><8> ><8> Verio Web Hosting, Inc.
hart@iserver.com ><8> ><8> ><8> http://www.iserver.com/
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0006281114550.31913-100000>