How do I allow only outbound ping and traceroute requests?

[BarryStiefel]

How do I allow only outbound ping and traceroute requests?



FireWall-1 versions prior to 4.0 do not perform stateful inspection of ICMP. In version 4.0 and later, FireWall-1 theoretically does stateful inspection of ICMP with the property enabled. However, I have seen/heard various reports about it not working correctly. If you do enable the ICMP property, enable it as "before last" and allow outbound ICMP explicitly in the rulebase.

In FireWall-1 NG, it's even more annoying -- you cannot disable stateful inspection of ICMP until NG AI.

The services you want to allow outbound (to the Internet) are: echo-request, traceroute

The services you want to allow inbound (from the Internet) are: echo-reply, time-exceeded, dest-unreach, param-prblm

Note that in version 4.0 and later, you will not need to explicitly allow the services inbound provided the "Enable ICMP" property is enabled per above, but you still will need to specify a rule to allow ICMP outbound. Alternative stateful inspection of ICMP code Bill Burns at Netscape Communications has developed some inspect code that handles stateful inspection of ping and traceroute (both the Microsoft and Unix varieties). His code works with 3.0 and 4.0 versions of FireWall-1. For more information, see his webpage.

Jean Chouanard also has some stateful inspection code for ICMP for FireWall-1 4.0 and 4.1.



-- GuyR - 12 Jan 2004

FAQForm FAQs.Class: ServicesFAQs FAQs.OS: FAQs.Version: