Blocking all ICMP traffic can disrupt normal networking. A suitable policy distinguishes messages required for communication, permitted diagnostics and traffic that belongs only on the local network.
ICMP does more than ping
Ping can help check reachability, but a missing response does not prove that a website is down. An application may respond while echo requests are filtered. A successful ping also does not establish that the website, email service or database works correctly.
Path-size discovery messages serve a different purpose. IPv4 “fragmentation needed” messages can report that a packet is too large; IPv6 “Packet Too Big” messages support path MTU discovery. Blocking them can contribute to connections that start normally and then stall.
Handle IPv6 separately
ICMPv6 also supports neighbour and router discovery. Rules depend on the message type, scope and firewall location. A requirement on the local link is not a reason to accept the same messages from the public internet.
Prepare a firewall change
- Identify exposed services, required traffic and approved monitoring sources.
- Retain a recovery connection independent of the rule being changed.
- Apply a targeted rule, then verify application behaviour over IPv4 and IPv6 where configured.
- Review logs and monitoring after the change.
Rate limits should suit the message involved. An excessively strict limit can itself disrupt communication. For a Nuagerie-managed service, confirm the applicable rules before changing access.
References: ICMPv6 filtering recommendations and IPv4 path MTU discovery.
