IPFW and icmp

[Dave]

I'm not a master of the internet RFCs, but I do believe icmp messages have
different types.

Now to enable traceroute for IPFW, I might put in a rule like this:

ipfw add pass icmp from any to me

However, how would I make a rule to limit icmp messages to just those used
by traceroute? Can the messages be distinguished as such?

A dynamic rule that exists only for the duration of a traceroute execution
would be even better. I take it 'setup' or 'check-state' would follow in
that case?

[chip]

Post by Dave
I'm not a master of the internet RFCs, but I do believe icmp messages have
different types.
ipfw add pass icmp from any to me
However, how would I make a rule to limit icmp messages to just those used
by traceroute? Can the messages be distinguished as such?
A dynamic rule that exists only for the duration of a traceroute execution
would be even better. I take it 'setup' or 'check-state' would follow in
that case?

Dave,

I can't comment much on how to build the exact rules you need, but
you should be made aware that different implementations of traceroute
achieve the results in different ways. Cisco routers and most *nix
boxen use UDP packets while Microsoft stuff uses ICMP. A good guide
to the difference:

http://www.cisco.com/warp/public/105/traceroute.shtml
http://lists.freebsd.org/pipermail/freebsd-security/2004-February/001585.html

# TRACEROUTE - Allow outgoing
${fwcmd} add pass udp from any to any 33434-33523 out via ${oif}

Hope this helps!

--chip

[Peter Pentchev]

Post by chip

Post by Dave
I'm not a master of the internet RFCs, but I do believe icmp messages have
different types.
ipfw add pass icmp from any to me
However, how would I make a rule to limit icmp messages to just those used
by traceroute? Can the messages be distinguished as such?
A dynamic rule that exists only for the duration of a traceroute execution
would be even better. I take it 'setup' or 'check-state' would follow in
that case?

Dave,
I can't comment much on how to build the exact rules you need, but
you should be made aware that different implementations of traceroute
achieve the results in different ways. Cisco routers and most *nix
boxen use UDP packets while Microsoft stuff uses ICMP. A good guide
http://www.cisco.com/warp/public/105/traceroute.shtml
http://lists.freebsd.org/pipermail/freebsd-security/2004-February/001585.html
# TRACEROUTE - Allow outgoing
${fwcmd} add pass udp from any to any 33434-33523 out via ${oif}

I think Dave was a bit more interested in setting up his rules for
*incoming* packets, not the outgoing ones :) No matter which favor of
traceroute is used, they all depend on receiving 'Time exceeded' ICMP
responses (type 11) - usually 'time exceeded in transit' (type 11, code
0), but allowing all of type 11 should put you on the safe side.

Also, when blocking incoming ICMP requests and replies, please, please,
*please* take care to NOT block type 3 (destination unreachable) -
blocking 'need to fragment' packets (type 3, code 4) is a way to instant
gratification, if your idea of gratification is being a blackhole router
which breaks the Path MTU discovery for any poor soul who decides (or
simply has to) route through you, and for your own outgoing connections,
too.

Other useful ICMP types are 0 (echo/ping reply), 4 (source quench, for
throttling down (usually) TCP connections if some device further down
the path cannot handle the packet rate), 8 (echo/ping request), 30
(Windows traceroute), but you *could* block those without much harm to
the TCP/IP protocol stack, the only thing harmed would be functionality
- e.g. blocking types 0 and 8 would deprive you of pings, blocking type
30 would stop Windows traceroute from working, blocking type 4 would
mean that TCP connections going over a much slower link somewhere down
the line would be additionally slowed down by lots of retransmissions
instead of simply bringing down the packet rate. However, whatever you
block, please don't block type 3 code 4, and better not block any of the
type 3's :)

G'luck,
Peter

[Laust Jespersen]

Post by Peter Pentchev

Post by chip

Post by Dave
I'm not a master of the internet RFCs, but I do believe icmp messages have
different types.
ipfw add pass icmp from any to me
However, how would I make a rule to limit icmp messages to just those used
by traceroute? Can the messages be distinguished as such?
A dynamic rule that exists only for the duration of a traceroute execution
would be even better. I take it 'setup' or 'check-state' would follow in
that case?

Dave,
I can't comment much on how to build the exact rules you need, but
you should be made aware that different implementations of traceroute
achieve the results in different ways. Cisco routers and most *nix
boxen use UDP packets while Microsoft stuff uses ICMP. A good guide
http://www.cisco.com/warp/public/105/traceroute.shtml
http://lists.freebsd.org/pipermail/freebsd-security/2004-February/001585.html
# TRACEROUTE - Allow outgoing
${fwcmd} add pass udp from any to any 33434-33523 out via ${oif}

I think Dave was a bit more interested in setting up his rules for
*incoming* packets, not the outgoing ones :) No matter which favor of
traceroute is used, they all depend on receiving 'Time exceeded' ICMP
responses (type 11) - usually 'time exceeded in transit' (type 11, code
0), but allowing all of type 11 should put you on the safe side.
Also, when blocking incoming ICMP requests and replies, please, please,
*please* take care to NOT block type 3 (destination unreachable) -
blocking 'need to fragment' packets (type 3, code 4) is a way to instant
gratification, if your idea of gratification is being a blackhole router
which breaks the Path MTU discovery for any poor soul who decides (or
simply has to) route through you, and for your own outgoing connections,
too.
Other useful ICMP types are 0 (echo/ping reply), 4 (source quench, for
throttling down (usually) TCP connections if some device further down
the path cannot handle the packet rate), 8 (echo/ping request), 30
(Windows traceroute), but you *could* block those without much harm to
the TCP/IP protocol stack, the only thing harmed would be functionality
- e.g. blocking types 0 and 8 would deprive you of pings, blocking type
30 would stop Windows traceroute from working, blocking type 4 would
mean that TCP connections going over a much slower link somewhere down
the line would be additionally slowed down by lots of retransmissions
instead of simply bringing down the packet rate. However, whatever you
block, please don't block type 3 code 4, and better not block any of the
type 3's :)
G'luck,
Peter

Apart from Peter's excellent clarification, let Me
recommend reading Dru Lavigne's great article series on ipfw
located at onlamp:

http://www.onlamp.com/pub/a/bsd/2001/04/25/FreeBSD_Basics.html
http://www.onlamp.com/pub/a/bsd/2001/05/09/FreeBSD_Basics.html
http://www.onlamp.com/pub/a/bsd/2001/06/01/FreeBSD_Basics.html

I found them very helpful when I started with ipfw.

Med venlig hilsen / Best Regards
Laust Jespersen

http://www.ust.dk
======================================================================
Viking Rule of Acquisition 1: Remember where you beached the long ship

[Kevin D. Kinsey, DaleCo, S.P.]

Post by Dave
I'm not a master of the internet RFCs, but I do believe icmp messages have
different types.
ipfw add pass icmp from any to me
However, how would I make a rule to limit icmp messages to just those used
by traceroute? Can the messages be distinguished as such?

I use, thus far, "allow icmp from any to any icmptypes 0,3,4,8,11". That
include 'echo request', of course. Someone else may have a better idea.

Post by Dave
A dynamic rule that exists only for the duration of a traceroute execution
would be even better. I take it 'setup' or 'check-state' would follow in
that case?

Seems likely. *sigh* one more manpage to read.... ;-)

Kevin Kinsey