Date: Tue, 12 Feb 2013 13:10:42 -0600 From: khatfield@socllc.net To: Fleuriot Damien <ml@my.gd> Cc: Norbert Aschendorff <norbert.aschendorff@yahoo.de>, "freebsd-isp@freebsd.org" <freebsd-isp@freebsd.org> Subject: Re: FreeBSD DDoS protection Message-ID: <943225264.98111.1360696244544@d94655abdbc041fe9f54c404b6b4e89c.nuevasync.com> In-Reply-To: <79C9AC81-7937-4C2D-8514-51CAEAF314E7@my.gd> References: <SNT002-W152BF18F12BD59F112A1CBAE5040@phx.gbl> <321927899.767139.1360461430134@89b1b4b66ec741cb85480c78b68b8dce.nuevasync.com> <51179708.2030206@epipe.com> <op.wsehxssd34t2sn@tech304.office.supranet.net> <511A733E.3000208@yahoo.de> <875329286.93002.1360690465766@d94655abdbc041fe9f54c404b6b4e89c.nuevasync.com> <79C9AC81-7937-4C2D-8514-51CAEAF314E7@my.gd>
next in thread | previous in thread | raw e-mail | index | archive | help
It does but possibly beneficial in some scenarios. I completely agree with =
keeping everything standard and not doing things that make other things eit=
her unpredictable or more difficult.=20
That's why I run MX80's instead of BSD-based edge gear any longer. Again, s=
imply trying to help the OP with his current equipment and basic needs to r=
esolve his present issue.
On Feb 12, 2013, at 11:46 AM, "Fleuriot Damien" <ml@my.gd> wrote:
>=20
> On Feb 12, 2013, at 6:34 PM, khatfield@socllc.net wrote:
>=20
>> As my response stated filter ICMP except where necessary. I can state co=
ming from a mitigation background that there are ways to safely do it witho=
ut causing any issues. However, yes, you can still filter ICMP and remain c=
ompliant with an example pf rule like:
>> icmp_types =3D "{ echoreq, unreach }"
>=20
> breaks traceroute :(
>=20
>=20
>=20
>> But in real life situations under constant attacks, blocking ICMP can be=
a large part of keeping businesses online.
>=20
> YMMV but I'd advise rate limiting instead of plain blocking.
>=20
> _______________________________________________
> freebsd-isp@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-isp
> To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?943225264.98111.1360696244544>