266
6620-3201
13.7 Filtering on ICMP Codes
An
ip-object
can be followed by an optional
[icmp]
fi
eld. This allows the script to
fi
lter packets
based on ICMP codes. ICMP packets are normally used to debug and diagnose a network and can
be extremely useful. However they form part of a low-level protocol and are frequently exploited by
hackers for attacking networks. For this reason most network administrators will want to restrict the
use of ICMP packets.
The syntax for including ICMP
fi
ltering is:
icmp = “icmp-type” icmp-type [“code” decnum]
The
icmp-type
can be one of the pre-de
fi
ned strings listed in the following table or the equivalent
decimal numeric value:
ICMP Type
ICMP Value
Unreach 3
Echo 8
Echorep 0
Squench 4
Redir 5
Timex 11
Paramprob 12
Timest 13
Timestrep 14
Inforeq 15
Inforep 16
Maskreq 17
Maskrep 18
Routerad 9
Routersol 10
The following two rules are therefore equivalent:
pass in break end on ppp 0 proto icmp from any to 10.1.2.0/24 icmp-type 0pass in
break end on ppp 0 proto icmp from any to 10.1.2.0/24 icmp-type echorep
Both of these rules allow echo replies to come in from interface
ppp 0
if they are addressed to our
example local network address (10.1.2.*).
In addition to having a type, ICMP packets also include an ICMP code
fi
eld. The
fi
lter syntax allows for
the speci
fi
cation of an optional code
fi
eld after the ICMP type. When speci
fi
ed the code
fi
eld must also
match. The ICMP code
fi
eld is speci
fi
ed with a decimal number.
For example, suppose we wish to allow only echo replies and ICMP unreachable type ICMP packets
from interface PPP 0. Then the rules would look something like this:
pass in break end on ppp 0 proto icmp from any to 10.1.2.0/24 icmp-type echorep
code 0 pass in break end on ppp 0 proto icmp from any to 10.1.2.0/24 icmp-type
unreach code 0 block in break end on ppp 0 proto icmp
The
fi
rst two rules in this set allow in the ICMP packets that we are willing to permit and the third rule
denies all other ICMP packets in from this interface. Now if we ever expect to see echo replies in
on
ppp 0
we should allow echo requests out on that interface too. To do that we would have the rule:
pass out break end on ppp 0 proto icmp icmp-type echo
