I am using mikrotik rb5009.
I have a question about icmp and firewall.
As shown in the figure below, I want to block icmp from outside to wan ip(port) and allow icmp from lan to wan ip.
Is there any way?
Any help would be appreciated.
In firewall … when constructing rules, you can either refer to in-interface or in-interface-list … or to src-address or src-address-list.
My opinion: blocking ICMP is largely overrated. Indeed it does slightly enlarge your footprint (i.e. potential attacker can easier determine if certain IP address is “alive” or not), but blocking ICMP itself doesn’t improve security of your network. When it comes to IPv6, blocking ICMP (if not very precise about which types and codes to block) can even break networking. So it’s better to let ICMP work and take care about security by other means.
There is no good reason to block ICMP and there are good reasons to allow ICMP.
IMO too strongly worded. If we started discussion about it (but I’m not going to participate), I could explain a few (IMO good) reasons to block some ICMP types and/or codes. But as you say, life is possible without blocking any ICMP and life sucks if one blocks too many ICMP.