Although it's not well known TCP seriously depends on ICMP packets of type 3 code 4 for "Path MTU Discovery" (PTMTUD). Blocking of these packets lead to congested IP connections, broken transmissions and thus to frustrated users.

Some documentation:

http://en.wikipedia.org/wiki/Pmtud

http://www.usenix.org/events/lisa02/tech/full_papers/vanderberg/vanderberg_html/

http://www.ietf.org/rfc/rfc2923.txt


Various serious solutions:


BSD:
  pass quick proto icmp from any to any icmp-type 3 code 4|

Linux:
  iptables -I CHAIN-NAME -p ICMP --icmp-type 3/4 -j ACCEPT


Check Point firewalls:
Explicitly allow ICMP type 3 code 4 packets to the servers that use Path MTU Discovery



A firewall that allows TCP and disallows ICMP type 3 code 4 is a broken firewall that should be repaired or replaced immediately since it's not usable for serious TCP traffic.


+++chefren

Reply via email to