Re: Wierd ICMP in logs

On Sun, 12 Sep 2004 18:51:20 +0000, Mark <bugtraq@mwebapps.com> wrote:
> I am running openBSD with PF for my firewall.
>
> I found these wierd entries in my log file:
> Sep 12 10:37:59.896280 rule 1/0(match): block in on xl0: 24.21.214.129 > 
> 68.*.*.*: icmp: host 192.168.1.100 unreachable [tos 0xc0]
> Sep 12 10:37:59.905766 rule 1/0(match): block in on xl0: 24.21.214.129 > 
> 68.*.*.*: icmp: host 192.168.1.100 unreachable [tos 0xc0]
> Sep 12 10:38:06.194229 rule 1/0(match): block in on xl0: 24.21.214.129 > 
> 68.*.*.*: icmp: host 192.168.1.100 unreachable [tos 0xc0]
>
> My question is why is it saying host 192.168.1.100 unreachable? Thats an 
> internal IP on my network, how can this 24.21.214.129 IP be pinging IP's on 
> my internal network?

not all icmp is ping.

this is an error message from 24.21.214.129, possibly your ISP's router
saying that you have sent out a packet with _destination_ address 192.168.1.100

There is obviously something wrong with your setup/rules, although it
is difficult to tell without more information.

> Is there something i can do to block this? I am currently blocking all 
> external icmp traffic.

You are already blocking this, it is in your logs marked as 'blocked'
to prevent the logs, you need to fix your ruleset/setup.

OpenBSD pf does the right thing with icmp error messages, and
associates it with the states. That means icmp errors related
to active states will pass through even if icmp is blocked.

Can