Re: ICMP Ruleset Behavior

--001a114702a416049c0538dcdc74
Content-Type: text/plain; charset=UTF-8

Excellent, Thank you, Tony, Ken!

On Sat, Jul 30, 2016 at 10:45 AM, Kenneth Gober <[email protected]> wrote:

> On Sat, Jul 30, 2016 at 12:08 AM, Aaron Hofer <[email protected]>
> wrote:
> >
> > pass out quick on egress inet proto icmp icmp-type echoreq no state
> > pass in quick on egress inet proto icmp icmp-type echorep no state
> > block quick on egress inet proto icmp all
> >
> > If I remove the 'no state' part, I can ping, but I don't need the second
> > line which I don't really understand why I don't.   So I guess my
> questions
> > are, why does the above ruleset not work, and why does it work if I
> remove
> > 'no state' or use default of keep state but comment out the second rule?
> > Shouldn't the echoreply packets be getting blocked on the way back in?
> >
> > What am I missing?  Do i need to do something with NAT's?
>
> It's not obvious to my why your ruleset isn't working as-is, but the reason
> it works if you remove the "no state" is because state is used not only for
> additional outbound packets, but also all the inbound reply packets.
>
> This allows you to remove the second line and tighten up your security.
> Instead of allowing any ICMP echo reply in (even unsolicited/forged
> replies)
> keeping state will allow only the specific replies that match
> previously-passed
> echo requests.
>
> Regarding NAT, ICMP traffic is no different from any other kind of IP
> traffic.
> If you need to use NAT for other things, you need it for ICMP also.  If
> your
> network configuration doesn't require NAT, then ICMP won't need it either.
>
> Note that NAT generally applies only to forwarded traffic.  Traffic
> that originates
> from your PF host won't typically need it.
>
> Whether you need NAT or not depends on the type of service you have
> from your ISP (or whoever is providing your egress network connection).
> You didn't say what it is, so I can't say whether you need it or not.
>
> -ken
>

--001a114702a416049c0538dcdc74
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Excellent, Thank you, Tony, Ken!</div><div class=3D"gmail_=
extra"><br><div class=3D"gmail_quote">On Sat, Jul 30, 2016 at 10:45 AM, Ken=
neth Gober <span dir=3D"ltr">&lt;<a href=3D"mailto:[email protected]" target=
=3D"_blank">[email protected]</a>&gt;</span> wrote:<br><blockquote class=3D"=
gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-=
left:1ex"><span class=3D"">On Sat, Jul 30, 2016 at 12:08 AM, Aaron Hofer &l=
t;<a href=3D"mailto:[email protected]">[email protected]</a>&gt; wrot=
e:<br>
&gt;<br>
&gt; pass out quick on egress inet proto icmp icmp-type echoreq no state<br=
>
&gt; pass in quick on egress inet proto icmp icmp-type echorep no state<br>
&gt; block quick on egress inet proto icmp all<br>
&gt;<br>
&gt; If I remove the &#39;no state&#39; part, I can ping, but I don&#39;t n=
eed the second<br>
&gt; line which I don&#39;t really understand why I don&#39;t.=C2=A0 =C2=A0=
So I guess my questions<br>
&gt; are, why does the above ruleset not work, and why does it work if I re=
move<br>
&gt; &#39;no state&#39; or use default of keep state but comment out the se=
cond rule?<br>
&gt; Shouldn&#39;t the echoreply packets be getting blocked on the way back=
 in?<br>
&gt;<br>
&gt; What am I missing?=C2=A0 Do i need to do something with NAT&#39;s?<br>
<br>
</span>It&#39;s not obvious to my why your ruleset isn&#39;t working as-is,=
 but the reason<br>
it works if you remove the &quot;no state&quot; is because state is used no=
t only for<br>
additional outbound packets, but also all the inbound reply packets.<br>
<br>
This allows you to remove the second line and tighten up your security.<br>
Instead of allowing any ICMP echo reply in (even unsolicited/forged replies=
)<br>
keeping state will allow only the specific replies that match previously-pa=
ssed<br>
echo requests.<br>
<br>
Regarding NAT, ICMP traffic is no different from any other kind of IP traff=
ic.<br>
If you need to use NAT for other things, you need it for ICMP also.=C2=A0 I=
f your<br>
network configuration doesn&#39;t require NAT, then ICMP won&#39;t need it =
either.<br>
<br>
Note that NAT generally applies only to forwarded traffic.=C2=A0 Traffic<br=
>
that originates<br>
from your PF host won&#39;t typically need it.<br>
<br>
Whether you need NAT or not depends on the type of service you have<br>
from your ISP (or whoever is providing your egress network connection).<br>
You didn&#39;t say what it is, so I can&#39;t say whether you need it or no=
t.<br>
<br>
-ken<br>
</blockquote></div><br></div>

--001a114702a416049c0538dcdc74--