ICMP, TCP:SA, TCP:R best practices?

motodude · Feb 4, 2012, 11:26 PM

I installed my pfsense firewall today and have it up and running. So far so good!

My logs are showing ICMP, TCP:SA and TCP:R as blocked. For now, I've allowed all ICMP to pass.

I searched this forum but didn't find what I was looking for. What is the best practice with ICMP? Allow everything or only the minimal (and if so, what) responses?

What about TCP:SA and TCP:R? I've googled and am not finding a description of those or a recommendation. I

cmb · Feb 5, 2012, 5:48 AM

You don't need to allow any ICMP. Any ICMP messages associated with a permitted connection are automatically allowed.

the SA and R are:
http://doc.pfsense.org/index.php/Logs_show_%22blocked%22_for_traffic_from_a_legitimate_connection,_why%3F