Internet Core Protocols: The Definitive Guide

Firewalls Blocking ICMP Traffic

Let’s say that you are trying to ping a remote web server. Perhaps you are able to connect to it using HTTP, but you are unable to get a response from it when using ping. In this case, it is entirely possible that your ICMP Echo Request messages are getting sent to the remote network, but that a firewall at the remote network is filtering out all incoming ICMP messages. In this case, your messages are simply getting eaten by the firewall, and no ICMP messages (neither ICMP query responses, nor ICMP errors) are being sent back.

Although the polite thing to do would be for the remote firewall to send a Destination Unreachable: Communication Administratively Prohibited error message, many network administrators consider these messages to be security holes, and disable their use on their firewalls. In this scenario, you would not receive any message back whatsoever.

Conversely, the problem may be with your firewall. It is entirely possible that your network administrator has also blocked all incoming ICMP messages, although outgoing messages are allowed to pass freely. In that situation, your ICMP Echo Request messages may be getting to the remote system—and it may be responding—but your firewall is blocking the responses from getting back into your network.

For example, Figure 5.43 shows Ferret sending an ICMP Echo Request query message to Fungi. Sasquatch is configured to allow traffic out from the 192.168.10.0 network, so it forwards the message on to ...