IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
If these rules are implemented alone, the establishment of communication
from the Internet is restricted to the enabled services. If the communication
partners can be further restricted (see above examples 2 and 3), an attacker
cannot set up any direct connection to the Internet server at all.
Note: The above rules may have the effect that the Internet server cannot be
reached from every computer because ICMP is not let through. It is therefore
advisable to let the ICMP subtype icmp unreachable through from the Internet
to the Internet server.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000