Re: can pf send icmp protocol unreachables?

return-icmp is only honoured for blocked UDP and TCP packets. ICMP and other protocols are silently blocked. I don't know where the ICMP port unreachable you're seeing comes from, but it's not from pf (unless the packet blocked was UDP or TCP).

We could add support for return-icmp for ICMP queries/replies (not for ICMP errors, you may never reply with another ICMP error to that) and other protocols, if anything is actually using that. What protocol/application actually reacts to ICMP errors for non-TCP/UDP packets?

Daniel Received on Tue Nov 26 12:10:50 2002