VS: can pf send icmp protocol unreachables?

Well, I try to look from the viewpoint of the attacker, and for instance nmap's protocol scan lets you what IP protocols the host in question answers to. Of course, it's pretty rare to be attacked through your mobileip software but I wouldn't be surprised if someday someone found a bug in the ESP implementation of a machine or what not.

As far as I know, blocking any other protocol requires an ICMP protocol unreachable (or of course a simple silent drop, but that's the crude way).

-- 
Toni Heinonen, Teleware Oy
  Wireless +358 (40) 836 1815
  Telephone +358 (9) 3434 9123
  toni.heinonen@teleware.fi
  www.teleware.fi

> -----Alkuperäinen viesti-----

> Lähettäjä: Daniel Hartmeier [mailto:daniel@benzedrine.cx] 

> Lähetetty: 26. marraskuuta 2002 19:01

> Vastaanottaja: Toni Heinonen

> Kopio: tech@openbsd.org

> Aihe: Re: can pf send icmp protocol unreachables?

> 

> 

> return-icmp is only honoured for blocked UDP and TCP packets.