From owner-freebsd-security  Sat Jun 10 13:59: 4 2000
Delivered-To: freebsd-security@freebsd.org
Received: from apollo.backplane.com (apollo.backplane.com [216.240.41.2])
	by hub.freebsd.org (Postfix) with ESMTP id AC16137BD68
	for <security@FreeBSD.ORG>; Sat, 10 Jun 2000 13:58:57 -0700 (PDT)
	(envelope-from dillon@apollo.backplane.com)
Received: (from dillon@localhost)
	by apollo.backplane.com (8.9.3/8.9.1) id NAA23380;
	Sat, 10 Jun 2000 13:58:43 -0700 (PDT)
	(envelope-from dillon)
Date: Sat, 10 Jun 2000 13:58:43 -0700 (PDT)
From: Matthew Dillon <dillon@apollo.backplane.com>
Message-Id: <200006102058.NAA23380@apollo.backplane.com>
To: sthaug@nethelp.no
Cc: ghormann@alumni.indiana.edu, vdrifter@ocis.ocis.net,
	security@FreeBSD.ORG
Subject: Re: Setting up simple firewall with ipfw
References: <200006101904.MAA22680@apollo.backplane.com> <89461.960668356@verdi.nethelp.no>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


:>     You also need to allow ICMP messages through, or TCP will not be
:>     able to do path-mtu-discovery.  I usually let pings through as well.
:> 
:> add ..... allow icmp from any to any icmptypes 0,3,5,8,11,12,13,14
:
:I can sort of understand 12 (Parameter Problem), but why on earth do
:you want to allow 13 and 14 (Timestamp/Timestamp Reply)?
:
:Steinar Haug, Nethelp consulting, sthaug@nethelp.no

    Well... why not?  A host-redirect ICMP is dangerous.  A timestamp/reply
    ICMP is not.

					-Matt
					Matthew Dillon 
					<dillon@backplane.com>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message