Hacker News new | past | comments | ask | show | jobs | submit login

some components, like RA and SLAAC, require specific ICMP to function properly. a properly configured IPv4 firewall on the other hand would allow no inbound and filter most outbound ICMP by default.

the only actually suspicious part of the original comment is...

  Default router settings - as configured by the ISP



> a properly configured IPv4 firewall on the other hand would allow no inbound and filter most outbound ICMP by default.

A properly configured IPv4 firewall would allow at least the "destination unreachable - fragmentation needed and DF set" inbound ICMP, otherwise path MTU discovery will break; it probably should also allow the rest of the "destination unreachable" inbound ICMP, and probably also the "time exceeded" inbound ICMP, so that connection failures are instantaneous instead of having to wait for a timeout.

Allowing no inbound ICMP at all is always an incorrect firewall configuration.


a properly configured (stateful) firewall permits replies to unfiltered outbound connections. you've made no corrections to anything i said, but merely added context to "filter most outbound connections" and with fair points.

but reasonable plumbers could and certainly do disagree on whether to allow any ICMP connections initiated from outside the firewall whatsoever.


The back and forth was a little confusing to me.

I forward/open IPv4 & IPv6 as needed, limited to trusted sources.

I allow IPv6 ICMP from approved countries. IIRC, this functionality goes beyond the needs of SLAAC and RA. It is a required criteria for IPv6 testing sites - but I'm not clear why.


Makes sense, thanks!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: