Which ICMP types to allow through a firewall
A common firewall configuration mistake is blocking all ICMP traffic to reduce attack surface. While the intent is reasonable, a blanket ICMP block breaks critical network functions including Path MTU Discovery (PMTUD), causes silent packet loss, and makes troubleshooting nearly impossible. Understanding which ICMP types are necessary and which are genuinely risky lets you write policies that are both secure and functional.
ICMP fundamentals and why it matters
ICMP (Internet Control Message Protocol, IP protocol 1) is not a transport layer like TCP or UDP. It carries diagnostic and error messages essential to IP routing and host communication. Each ICMP message has a Type field (0-255) that defines its purpose. Echo Request (Type 8) and Echo Reply (Type 0) are what ping uses. Type 3 (Destination Unreachable) carries fragmentation-needed signals that PMTUD depends on. Type 11 (Time Exceeded) is used by traceroute. Blocking all of these indiscriminately causes problems that are hard to diagnose because the failures are silent.
The PMTUD problem: why Type 3 code 4 cannot be blocked
Path MTU Discovery allows hosts to discover the smallest maximum transmission unit (MTU) along a path to a destination. When a router receives a packet larger than its outgoing interface MTU, it drops the packet and sends back an ICMP Type 3 (Destination Unreachable), code 4 (Fragmentation Needed and DF Set). This message tells the sender to reduce its packet size and retry. If your firewall blocks this ICMP type, the sender never learns it must fragment. It keeps sending oversized packets that silently disappear. Users experience intermittent connectivity: small requests work, large file transfers stall or fail. This is one of the hardest problems to troubleshoot because there is no obvious error message.
Modern IPv6 requires PMTUD and does not allow fragmentation by intermediate routers, making Type 3 code 4 even more critical in dual-stack networks.
ICMP types to permit and why
- →Type 0 (Echo Reply) and Type 8 (Echo Request): Permit both directions to allow ping. Ping is invaluable for basic reachability testing and latency measurement. Blocking ping makes troubleshooting harder and does not significantly improve security.
- →Type 3 (Destination Unreachable), code 4 (Fragmentation Needed): Must permit inbound to the local network. This is the PMTUD signal. Code 0 (Net Unreachable), code 1 (Host Unreachable), and code 13 (Communication Administratively Prohibited) can also be useful for path diagnostics.
- →Type 11 (Time Exceeded): Permit inbound. Traceroute uses this to map the path to a destination. It is harmless and useful.
- →Type 12 (Parameter Problem): Permit inbound. Signals malformed packets; rare but legitimate.
- →Type 30 (Traceroute): Permit inbound if you support traceroute queries. Less common than Type 11.
ICMP types to block or restrict
- →Type 8 (Echo Request) outbound from internal hosts: Some organizations block outbound ping to prevent reconnaissance. This is a policy choice, not a functional requirement.
- →Type 13 (Timestamp Request) and Type 14 (Timestamp Reply): Rarely used; safe to block.
- →Type 17 (Address Mask Request) and Type 18 (Address Mask Reply): Obsolete; safe to block.
- →Type 9 (Router Advertisement) and Type 10 (Router Solicitation): Block unless you use ICMP for router discovery (uncommon in modern networks).
Practical firewall rules
# Permit inbound ICMP for PMTUD and diagnostics allow icmp type 3 code 4 inbound allow icmp type 0 inbound (echo reply) allow icmp type 11 inbound (time exceeded) allow icmp type 12 inbound (parameter problem) # Permit echo request inbound for testing allow icmp type 8 inbound # Permit outbound echo request for testing allow icmp type 8 outbound # Block everything else block icmp
Test your rules by sending large ping packets (ping -M do -s 1472 destination on Linux) across a path with a smaller MTU. If PMTUD works, the sender reduces packet size automatically. If it fails silently, check that Type 3 code 4 is permitted.