Re: FreeBSD DDoS protection

Janne Snabb <[email protected]> Sun, 10 Feb 2013 14:48:08 +0200

Newsgroups	gmane.os.freebsd.security.general,gmane.os.freebsd.isp
Message-ID	<[email protected]>

On 2013-02-10 03:57, [email protected] wrote:
> Deny all ICMP (drop I mean) and UDP except where specifically required.

Please do not drop all ICMP unless you understand what you are doing. By
doing that you are creating a path MTU discovery blackhole.

See for example the following sites for more information:

http://www.phildev.net/mss/
https://supportforums.cisco.com/docs/DOC-5839
http://www.cymru.com/Documents/icmp-messages.html
http://packetlife.net/blog/2008/oct/09/disabling-unreachables-breaks-pmtud/

-- 
Janne Snabb / EPIPE Communications
[email protected] - http://epipe.com/
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "[email protected]"