How do I permit only specific types of ICMP unreachable packets to be sent out from a Cisco IOS router? [closed]

Question

I have a Cisco IOS router and want to permit only types of ICMP packets to be sent (type 8, code 0 and type 3, code 4). I tried putting an outbound ACL on the interface connecting to the Internet, but my packet capture still shows that the router is sending all types of ICMP unreachables to systems port scanning me.

I understand that there's a "no ip unreachables" interface command, but that disables all types of ICMP unreachables from being sent out.

How can I limit the types of ICMP unreachables that the router sends out?

Answer 1

If you want to prevent ICMP unreachable from an interface in a Cisco router, you can use the no ip unreachables interface command.

To prevent ICMP echo requests or echo replies, you can use an extended access list. You have not given us the ACL you tried, so we really don't know what you did wrong for this. You probably want to stop the ICMP echo requests inbound, rather than the ICMP echo replies outbound. That way, the router doesn't need to route the requests, and the target of the requests doesn't need to generate a reply, only to have it stopped.

In general, extended ACLs should be applied inbound, as close to the source as possible. This prevent the router from having to waste resources routing packets that are destined to be dropped.

Something like:

ip access-list extended STOP_PING_REQUESTS_INBOUND
 remark Deny inbound ICMP echo requests
 deny icmp any any echo
 remark Permit any other inbound traffic
 permit ip any any
!
interface <interface>
 no ip unreachables
 ip access-group STOP_PING_REQUESTS_INBOUND in
!

---

There are also a few specific ICMP unreachable messages you could prevent outbound The list of ICMP options on my IOS version (15.5) are:

Router(config-ext-nacl)#deny icmp any any ?
  <0-255>                      ICMP message type
  administratively-prohibited  Administratively prohibited
  alternate-address            Alternate address
  conversion-error             Datagram conversion
  dod-host-prohibited          Host prohibited
  dod-net-prohibited           Net prohibited
  dscp                         Match packets with given dscp value
  echo                         Echo (ping)
  echo-reply                   Echo reply
  fragments                    Check non-initial fragments
  general-parameter-problem    Parameter problem
  host-isolated                Host isolated
  host-precedence-unreachable  Host unreachable for precedence
  host-redirect                Host redirect
  host-tos-redirect            Host redirect for TOS
  host-tos-unreachable         Host unreachable for TOS
  host-unknown                 Host unknown
  host-unreachable             Host unreachable
  information-reply            Information replies
  information-request          Information requests
  log                          Log matches against this entry
  log-input                    Log matches against this entry, including input interface
  mask-reply                   Mask replies
  mask-request                 Mask requests
  mobile-redirect              Mobile host redirect
  net-redirect                 Network redirect
  net-tos-redirect             Net redirect for TOS
  net-tos-unreachable          Network unreachable for TOS
  net-unreachable              Net unreachable
  network-unknown              Network unknown
  no-room-for-option           Parameter required but no room
  option                       Match packets with given IP Options value
  option-missing               Parameter required but not present
  packet-too-big               Fragmentation needed and DF set
  parameter-problem            All parameter problems
  port-unreachable             Port unreachable
  precedence                   Match packets with given precedence value
  precedence-unreachable       Precedence cutoff
  protocol-unreachable         Protocol unreachable
  reassembly-timeout           Reassembly timeout
  redirect                     All redirects
  router-advertisement         Router discovery advertisements
  router-solicitation          Router discovery solicitations
  source-quench                Source quenches
  source-route-failed          Source route failed
  time-exceeded                All time exceededs
  time-range                   Specify a time-range
  timestamp-reply              Timestamp replies
  timestamp-request            Timestamp requests
  tos                          Match packets with given TOS value
  traceroute                   Traceroute
  ttl                          Match packets with given TTL value
  ttl-exceeded                 TTL exceeded
  unreachable                  All unreachables
  <cr>