::::::::::::::::::::::::
Tuning (c) by Mr.Goblins
;;;;;;;;;;;;;;;;;;;;;;;;

= = = = = = = = = = = = = = = = = = = = = = = = = = = = =
   Internet Control Message Protocol (ICMP) filtrēšana
= = = = = = = = = = = = = = = = = = = = = = = = = = = = =

(Introduction)
70% gadījumos kad ir iegūtas basic zināšanas TCP/IP uzbūvē
un ir tas gods aizsargāt sevi/firmu/*ISP* :) no ļaundariem
doma ir skaidra un tā ir sekojoša:
  ---drop all damn ICMP trafic; allow only ping other machines!!!---
U-u-u-p-s!!!
ICMP nav tikai tūlis ar ko var PingFloodu laist vai tracertot hostus.
ICMP 70-100bytes liela datagramma, kurus izgriežot var sataisīt tikai problēmas.
Problēmas nav ar aci pamanāmas, kurās parasti vaino upstream provaiderus xor linku xor OS.
Need more info? -> Google is your friend!

= = = = =
Šādus Headerus ICMP pievieno IP paketei:
+----------+----------+------------------------------------------+
|     8    |    16    |                   32bits                 |
+----------+----------+------------------------------------------+
|   Type   |   Code   |                  CheckSum                |
+----------+----------+------------------------------------------+
|     Identifier      |              SequenceNumber              |
+---------------------+------------------------------------------+
|                              DATA                              |
+----------------------------------------------------------------+

 Type
  0	Echo Reply
  1	Unassigned
  2	Unassigned
  3	Destination Unreachable
	Codes
		0  Net Unreachable
		1  Host Unreachable
		2  Protocol Unreachable
		3  Port Unreachable
		4  Fragmentation Needed and Don't Fragment was Set
		5  Source Route Failed
		6  Destination Network Unknown
		7  Destination Host Unknown
		8  Source Host Isolated
		9  Communication with Destination Network is
			Administratively Prohibited
		10  Communication with Destination Host is
			Administratively Prohibited
		11  Destination Network Unreachable for Type of Service
		12  Destination Host Unreachable for Type of Service
		13  Communication Administratively Prohibited
		14  Host Precedence Violation
		15  Precedence cutoff in effect
  4	Source Quench
  5	Redirect
  6	Alternate Host Address
  7	Unassigned
  8	Echo
  9	Router Advertisement
 10	Router Solicitation
 11	Time Exceeded
	Codes
		0  Time to Live exceeded in Transit
		1  Fragment Reassembly Time Exceeded
 12	Parameter Problem
 13	Timestamp
 14	Timestamp Reply
 15	Information Request
 16	Information Reply
 17	Address Mask Request
 18	Address Mask Reply
 19	Reserved (for Security)
 20-29	Reserved (for Robustness Experiment)
 30	Traceroute
 31	Datagram Conversion Error
 32     Mobile Host Redirect
 33     IPv6 Where-Are-You
 34     IPv6 I-Am-Here
 35     Mobile Registration Request
 36     Mobile Registration Reply
 37     Domain Name Request
 38     Domain Name Reply
 39     SKIP
 40     Photuris
 41-255 Reserved
= = = = =

(Workstation protected by Tiny Personal Firewall)

(*) allow - icmp type(3)   - In
(*) allow - icmp type(4)   - In/Out
(*) allow - icmp type(8)   - Out
(*) allow - icmp type(0)   - In
(*) allow - icmp type(11)  - In
(*) deny  - icmp type(ALL) - In/Out



(Router CISCO || FreeBSD)

(*) allow - icmp type(3)   - In/Out [through any interface]
(*) allow - icmp type(4)   - In/Out [through any interface]
(*) allow - icmp type(11)  - In     [through WAN interface]

# Ja rūteris ir reālais zvērs, un darbina BGP xor EIGRP xor
# citu biezo RoutingProtocolu, un runājas iekšienē ar daudziem
# citiem tādiem pašiem zvēriem, un ja vel viņos ienāk
# daudzu AutonomoSistemu trafika, un ja vel rūteris ir
# tranzīt AS prieks citam AS, tad nu šo rindiņu vajag :)))
(*) allow - icmp type(11)  - In/Out [through any interface]

# Ja gribam lai locālis var pingot ārpasauli
(*) allow - icmp type(8)   - Out    [through LAN interface]
(*) allow - icmp type(0)   - In     [through WAN interface]

# Ja gribam lai ārpasaule var mūs nopingot (DoS rock)
(*) allow - icmp type(8)   - In     [through WAN interface]
(*) allow - icmp type(0)   - Out    [through LAN interface]

# Drop All other SPAM
(*) deny  - icmp type(ALL) - In/Out [through any interface]

= = = = =

-type(0)(Echo Reply) - No Comment!
-type(8)(Echo)       - No Comment!

-type(3)(Destination Unreachable) -
   ja nogriež, tad var rasties problēmas ar performanci,
   kad conectejas ar remote hostu un pa ceļam MTU atšķiras
   un ir nepieciešama fragmentācija. (Path-MTU Discovery)

-type(4)(Source Quench) -
   ja receiver nespēj apstrādāt data flow, viņš suta šādu
   sms lai senders mazliet slow-down, ja šīs sms tiek
   izfiltrētas, reveicers dropo paketes kad queue ir pilna.
   secinājumi acīm redzami!

-type(11)(Time Exceeded) -
   ja rūteris redz paketi ar TTL=0, tas suta SourceIP šo sms.
   tas nozīmē ka ir loops vai arī too many hops/delay.
   traceroute ari izmanto TTL+UDP lai redzētu path.