Re: Discarding inbound ICMP REDIRECT by default
Ed Maste <[email protected]>
| Newsgroups | gmane.os.freebsd.devel.net |
|---|---|
| Message-ID | <CAPyFy2DmbfYOYvWKm7+fq5RMgM8que6OW7LKJHKoMH=L+9-wwg@mail.gmail.com> |
On Wed, 12 Jun 2024 at 18:05, Chris <[email protected]> wrote: > > As Rodeney already effectively explains; dropping packets makes routing, > and discovery exceedingly difficult. Which is NOT what the average user > wants, This is on end hosts only, not routers (which already drop ICMP REDIRECT). > or expects. I use "set block-policy drop" in pf(4). But as already noted, > this is for "filtering" purposes. Your suggestion also has the negative > affect > of hanging remote ports. Which can result in other negative results by peers. I don't follow -- how does a host not processing ICMP REDIRECT cause these effects?