Mastering Linux Security and Hardening - Second Edition

Blocking ICMP

Let's take another look at the status of the default public zone:

[donnie@localhost ~]$ sudo firewall-cmd --info-zone=publicpublic (active)  target: default  icmp-block-inversion: no  interfaces: enp0s3  sources:   services: ssh dhcpv6-client  ports: 53/tcp 53/udp  protocols:   masquerade: no  forward-ports:   source-ports:   icmp-blocks:   rich rules: [donnie@localhost ~]$

Toward the bottom, we can see the icmp-block line, with nothing beside it. This means that our public zone allows all ICMP packets to come through. This isn't ideal, of course, because there are certain types of ICMP packets that we want to block. Before we block anything, let's look at all of the ICMP types that are available to us:

[donnie@localhost ~]$ sudo firewall-cmd ...