Let's build a good starting point for ICMP design across a firewall.
First, I'll orient you to this diagram.
Traffic flowing from left to right will be colored blue as it originates from
Globomantics and moves into Wired Brain Coffee Company.
Traffic flowing from right to left is orange and represents reply traffic.
Why do we care about reply traffic?
A properly configured firewall should consider flows
moving in all directions across it, not just one way,
and so we should construct ACLs to handle traffic both ways.
Since there are many different messages flowing in different directions,
we must recall what we've learned so far and apply it here.
First, let's tackle the easy stuff.
In many environments, we want ICMP ping to work.
That means ICMP echo‑requests from the Globomantics
client towards the remote server.
What should the server send in reply?
ICMP echo‑reply messages, which need to be permitted on the way back.
Let's work through traceroute next.
I'm going to ask a lot of questions here,
so feel free to pause the video after any question if you'd like to ponder it.
When the client takes off a traceroute, what packets does it send?
UDP probes with destination ports starting from 33434.
Just a note that sometimes the upperbound of this port
range is implementation dependent,
but it is usually 33464 for non‑Windows operating systems.
Also recall that Windows uses ICMP echo‑requests for traceroute.
After the probes pass through the firewall,
what kinds of messages might need to flow the other way?
I can think of two,
the ICMP TTL exceeded for intermediate router hops and the ICMP
port unreachable for the final destination.
What about fragmentation signaling?
We don't need to permit any new traffic from Globomantics since
we already permitted ICMP ping to test MTUs.
We do need to allow the ICMP packet too big unreachable to be sent in reply.
These might originate from any routers in the Wired Brain Coffee network.
What about those admin prohibited packets we saw in the previous demo?
Those are originated by the firewall itself and are type 3, code 13.
Don't worry, we'll deep dive this one soon,
but for now,
just know that it's sometimes a good idea to allow firewalls to send these
unreachables towards the trusted inside of a network.
One last point before we continue to the next video.
There are a few more useful ICMP messages that might
make sense to permit across a firewall,
and I'll describe them briefly later in this module.
The point of this high‑level design is to give you a starting point,
not provide a comprehensive one‑size‑fits‑all ICMP security solution.
Let's get back into the scenario to test traceroute again and see if our solution worked.