How does Asus merlin handle ICMP redirects if "Respond ping request from WAN" is enabled?

[reerden]

According to this post by Rmerlin: http://www.snbforums.com/threads/block-ping-all-icmp.14269/ ,

the option "Respond ping request from WAN" adds a firewall rule allowing all ICMP packets when enabled. How does the firmware handle ICMP redirects when this is enabled? Does it only allow ICMP redirects from the default gateway or all sources? Isn't this a security risk or is this type of ICMP message still blocked?

 

[RMerlin]

According to this post by Rmerlin: http://www.snbforums.com/threads/block-ping-all-icmp.14269/ ,

the option "Respond ping request from WAN" adds a firewall rule allowing all ICMP packets when enabled. How does the firmware handle ICMP redirects when this is enabled? Does it only allow ICMP redirects from the default gateway or all sources? Isn't this a security risk or is this type of ICMP message still blocked?

That stuff is handled by iptables and the kernel, not the firmware. So whatever behaviour would be what Linux does by default.

 

[mstombs]

I like this option, it adds a specific accept rule fo external pings to the router itself only

ASUSWRT-Merlin RT-N66U_3.0.0.4 Fri Jul 17 03:15:20 UTC 2015
admin@RT-N66U:/tmp/home/root# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination
1023 51987 DROP       all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           state INVALID
559K   69M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
  262 49053 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           state NEW
95146   15M ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0           state NEW
  487  162K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spt:67 dpt:68
312K 8741K ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0

Why so many?

 

[reerden]

That stuff is handled by iptables and the kernel, not the firmware. So whatever behaviour would be what Linux does by default.

Thanks. I'm not sure, but from what I've read, Linux by default only allows ICMP redirects coming from the default gateway.

Also, do I need to have the respond to ping request enabled if I'm hosting something like a game server, for things like path MTU? I've also read that Linux doesn't respond to path MTUs by default so it seems enabling this option does nothing to help that but I'm not sure.