Re: Wierd ICMP in logs

I'm not familiar with your fw, so I can only assume its referring to 
Destination Unreachable (ICMP Type 3). They're sent in response
to a connection request that, for whatever reason, cannot be delivered. 
Possibly the server or service is not available.

The most likely cause is one of your internal users clicked on a dead link
in a web page, causing the unreachable message to be sent back.
It's ok to allow them inbound.

I found these links helpful for sorting out ICMP:
http://www.networkmagazine.com/article/NMG20000829S0003
http://www.sys-security.com/html/projects/icmp.html


Regards,
Gary

----- Original Message ----- 
From: "Mark" <bugtraq@mwebapps.com>
To: <firewalls@securityfocus.com>
Sent: Sunday, September 12, 2004 2:51 PM
Subject: Wierd ICMP in logs


I am running openBSD with PF for my firewall.

I found these wierd entries in my log file:
Sep 12 10:37:59.896280 rule 1/0(match): block in on xl0: 24.21.214.129 >
68.*.*.*: icmp: host 192.168.1.100 unreachable [tos 0xc0]
Sep 12 10:37:59.905766 rule 1/0(match): block in on xl0: 24.21.214.129 >
68.*.*.*: icmp: host 192.168.1.100 unreachable [tos 0xc0]
Sep 12 10:38:06.194229 rule 1/0(match): block in on xl0: 24.21.214.129 >
68.*.*.*: icmp: host 192.168.1.100 unreachable [tos 0xc0]

My question is why is it saying host 192.168.1.100 unreachable? Thats an
internal IP on my network, how can this 24.21.214.129 IP be pinging IP's on
my internal network? Is there something i can do to block this? I am
currently blocking all external icmp traffic.

PS: I have * out my ip address.

Thanks
---------------------