FireWall-1 FAQ: DNS and ICMP Allowed?
Please note: This content was from when I was operating my FireWall-1 FAQ site, which I stopped operating in August 2005. For some reason people still have links to this stuff on the Internet that people are still clicking on.
I am making this information available again AS IS. Given how old this information is, it is likely wildly inaccurate. I have no plans to update this information.
If you're still running versions of Check Point VPN-1/FireWall-1 where this information is still relevant to you, do yourself a favor and upgrade to a more recent release. If you happen to be running a current release and the information is useful, it's by happenstance :)
DNS and ICMP can both controlled by the Rulebase Properties screen. By default:
- DNS is accepted and not logged before the first rule in your rulebase.
- ICMP is accepted and not logged before the last rule in your rulebase. This means if you have rules blocking it before your last rule in your rulebase, they will apply.
These can be set to your tastes (or disabled entirely). See How Can I Disable Everything in Rulebase Properties for more information.
