What is ICMP and which messages should a firewall allow?

The Internet Control Message Protocol (ICMP) carries error reports and diagnostics for IP, such as "destination unreachable" or "time exceeded". Ping and traceroute use it. Blocking all ICMP is a common firewall mistake that breaks real traffic, especially on IPv6. Allow the required message types and rate limit the rest.

What is ICMP for?

RFC 792, from 1981, says ICMP is an integral part of IP and must be implemented by every IP module. When a datagram cannot reach its destination, or a gateway lacks buffer space, or a better route exists, ICMP is how the network tells the sender. The RFC is explicit that the purpose is feedback about problems, not to make IP reliable: there are still no guarantees that a datagram will be delivered or a control message returned.

To avoid endless chains, no ICMP messages are sent about ICMP messages.

Which messages matter?

• Echo request and echo reply. Used by ping to test reachability.
• Destination unreachable. Tells the sender the packet could not be delivered, with a code for why.
• Time exceeded. The basis of traceroute, which sends packets with increasing hop limits and listens for these replies.
• Packet too big (ICMPv6, and fragmentation needed in ICMPv4). Tells the sender that a packet exceeded the link size so it can send smaller ones.

Why is blocking all of it harmful?

Path MTU discovery depends on the packet too big message. If a firewall drops it, a large transfer can stall: small packets work, such as the start of a connection, but larger ones vanish without any error reaching the sender. The symptom, a connection that hangs after it opens, is among the hardest to diagnose.

In IPv6 the stakes are higher because routers do not fragment packets in transit. RFC 4890, recommendations for filtering ICMPv6 messages in firewalls, has a section titled "Traffic That Must Not Be Dropped" and a dedicated treatment of Packet Too Big. It also covers neighbor discovery messages, which IPv6 uses for basic local operation.

What are the real risks?

ICMP has also been used for reconnaissance (mapping which hosts are alive), for covert channels that hide data in message payloads, and for flooding. So the answer is neither "allow everything" nor "block everything".

A constructed example

A company enables an IPv6 service behind a new firewall using a template that drops all ICMP. Web pages load, but uploads of large files freeze. The packet capture shows full size packets leaving and no replies. After permitting packet too big and the other required ICMPv6 types, uploads work. The team also keeps echo requests limited to internal monitoring sources and applies rate limits to the rest.

How do you test it?

Send a large payload across the path with the do not fragment flag set and see where it fails. Use traceroute from outside to confirm what your edge reveals about internal hops. Capture traffic while a transfer stalls and look for missing packet too big messages. Do the tests again after every firewall change, because rule updates often reintroduce blanket drops.

How to check or apply this

1. List ICMP and ICMPv6 types and codes your firewall currently drops.
2. Permit the types RFC 4890 says must not be dropped, in both directions as it specifies.
3. Rate limit echo and other informational messages at the edge.
4. Restrict echo requests from the internet if you do not need them, and allow from monitoring addresses.
5. Log dropped ICMP at low volume so you can diagnose problems.
6. Test path MTU behavior with large packets after every firewall change.
7. Inspect ICMP payload sizes for oddities when hunting for covert channels.

Quick check

Sources

• RFC 792, Internet Control Message Protocol
• RFC 4443, ICMPv6 for IPv6
• RFC 4890, Recommendations for Filtering ICMPv6 Messages in Firewalls

Last reviewed: 18 October 2026.