"reject" rule and icmp.

[apollo13]

I have a rule for testing purposes which is set to reject and destination 33.33.33.33. Now if I try telnet, pfsense will immediately close the tcp connection, so far so good. If I use ping instead, pfsense just drops the icmp echo request and does not send icmp unreachable or anything back. According to https://redmine.pfsense.org/issues/2452 this appears to be intended behavior. Can anyone explain why?

Thanks,
Florian

[cmb]

That's the nature of how pf functions. Its reject will send a RST for TCP, an unreachable for UDP, and nothing for all other protocols.

For ICMP in particular, RFC 792's "To avoid the infinite regress of messages about messages etc., no ICMP messages are sent about ICMP messages." is likely why.

[apollo13]

Ah thank you, the pf docs said "This causes a TCP RST to be returned for tcp(4) packets and an ICMP UNREACHABLE for UDP and other packets." – so I expected an ICMP return even for ICMP.