PF rule to disable icmp?

[cyanide_christ]

Hallo guys!

My first question on this forum so be nice to me

Does somebody have an great pf rule for disable my firewall to respond
to incomming imcp requests from internet. I have tried some, but it doesn´t work.

/Cy

[cyanide_christ]

Of course it should be ICMP! sorry...

[Carpetsmoker]

Not so difficult I would say:

block in on $ext_if inet proto icmp all

Or block all ICMP except ping:

pass in on $ext_if inet proto icmp all icmp-type echoreq keep state

[cyanide_christ]

Okey tnx... But were in the pf.conf would you put it? I know it should lie under the filter rules, but were in the order? I mean is there any problem by lie the rule in the end or is it supposed to be in the beginning of the filter rule section?

The file is read from top to bottom so the logic says that it should counter...

/cy

[jggimi]

Block and Pass normally work via "last matching rule wins". If all of your pass rules are for other protocols, then a block for ICMP may go anywhere.

If you add the "quick" parameter to a rule, if the rule matches, PF stops testing the packet and performs the block or the pass immediately.

Blocking ICMP can block proper use of TCP/IP, and cause some applications to fail.

[mikesg]

When you ask "where should it go", I interpret that as you haven't even begun to read the documentation. When I first tried OpenBSD with the intent of setting it up as a gateway/firewall and no prior experience with it, it took me about 2-1/2 hours. My network was online with a basic pf ruleset in place which included some port redirection and dis/allowed services. This included going through the Basic Configuration section of the PF FAQ, as well as documentation for the other services I needed running. I only say that to give you an idea of how much time it took for one person read through it.

http://www.openbsd.org/faq/pf/

Go through the Basic Config section there. It doesn't take that long, and ALL of the information there is going to be helpful, including where you put rules, which is in the very first link: Getting Started.

[ocicat]

To compliment mikesg's assertion that reading the documentation is paramount, the OP should also take the time to read Hansteen's "Firewalling with PF" manuscript:

http://home.nuug.no/~peter/pf/

...which serves as the basis for his later work, The Book of PF.