If I configure an Amazon AWS VPC, should I explicitly allow ICMP "destination unreachable" packets outbound? I am wanting the VPC firewall to block everything by default, however does this mean this (potentially) breaks things for DSL traffic, or would this be OK assuming all virtual appliances behind AWS do not restrict MTU to 1492? Although in this case some traffic is routed to other external networks. I am also assuming that if I enable this it should be for egress traffic only. I suppose my main question is why isn't this a default rule if it is safe? - Mark's current answer says ICMPTX is not a real threat on a network that you have control of.
In Thomas Pornin's answer on Security risk of PING he states:
Some ICMP packet types MUST NOT be blocked, in particular the "destination unreachable" ICMP message, because blocking that one breaks path MTU discovery, symptoms being that DSL users (behind a PPPoE layer which restricts MTU to 1492 bytes) cannot access Web sites which block those packets (unless they use the Web proxy provided by their ISP).
How likely are the default rules to break things if blocking ICMP "destination unreachable" as Thomas points out? Should time and effort be spent to explicitly allow these on each VPC and subnet firewall and ACL rule?
Aucun commentaire:
Enregistrer un commentaire