Quantcast
Channel: All SRX Services Gateway posts
Viewing all articles
Browse latest Browse all 17645

Re: Filter ICMP Packets

$
0
0

Hi, 

 

How does your LAN traffic reach the Internet? Is there any NAT and what is the NAT pool, is it the interface or a separate NAT pool?

ping from LAN to Internet stopped most probably because return icmp packets [echo replies] are not reaching back the LAN hosts [term 4].

 

Adding a term to allow "icmp-type echo-reply" will still not allow any hosts to ping the public IP interface as a host trying to ping the public IP interface would send an icmp echo-request, and normally an icmp echo-reply would be sent back as reply.

 

As such, you could as well implement output filters to block outgoing echo-replies or other icmp-types used for reconnaissance such as timestamp-reply, mask-reply, info-reply etc from leaving the public IP interface.

 

For the LAN hosts to be able to ping Internet, the return ICMP packets need to be allowed through.

 

Cheers,

Ashvin


Viewing all articles
Browse latest Browse all 17645

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>