Cannot block incoming ping responses
-
Coming from iptables, setting up ping behavior is more complicated. So, I was surprised that by blocking ping requests on WAN to ANY incoming pings are out. Yet, LAN can ping outside and receive a reply. Perfect.
For testing, I wanted to block ping responses on WAN to lan address. This should also "stop" LAN pings to the outside (because the response cannot come back to LAN). However, it does not.
Any idea why?
I switched off "Block private networks" and "Block bogus networks" to be able to test on a private network.
-
If you don't want your lan to ping stuff outside pfsense, then create a lan rule to block ICMP from going out in the first place.
-
To reach the goal (as in "use case"), I totally agree. However, the firewall should be able to block incoming ping replies. And somehow, I am unable to set this up.
-
If you allow icmp out, then your allowing the state to be created - now you want a rule to deny the return traffic to the state.. That is not the logical way to go about what your wanting to do.
The logical way to accomplish your goal is to never allow outbound in the first place to things you don't want your clients to do.
