Is allowing Ping on a workstations safe

[genesis]

Hi

 

We have windows 2012 DC and Windows 7 clients in our network. The workstations were not pinging. So on the OU where all the students PC are located.

I created a GPO and Computer Configuration-Policies-Administrative Templates-Network-Network Connections-Windows Firewall-Domain Profile.

 

Allowed ICMP exceptions and Windows Firewall:

Allow inbound file and printer sharing exception.

Is this safe to do so. Any suggestions much appreciated.

 

Thanks

[Davit2005]

Within a Domain network IMO then yes, set the Firewall policy for Domain. This should then protect laptops if they are taken off domain. I've also allowed RDP again from within the domain only.

[Rob_D]

Everywhere I've ever worked we've just turned off the windows firewall for domain connections, and relied on 3rd party endpoint protection and HW or router firewalls on the incoming internet connection.

 

To my mind what you're doing sounds perfectly safe (so long as you're only doing it for the domain profile), and probably necessary if you want to be able to connect to the computer in any meaningful way.

[ledow2]

Ping is harmless. At best it lets you detect presence of a machine on a certain IP (which is exactly its purpose!).

 

If you're offering out file and print sharing, that's a) more dangerous and b) doing exactly the same (i.e. letting people know the machine is there).

 

The paranoid people who worry about ping packets don't realise that almost all scanning tools since the 90's have had "don't wait for ping reply" options, and can probe every port on the machine / connection in seconds whether or not ICMP echo responses are received. If you're offering any service at all, whatsoever, then ping does nothing more than you're already doing.

 

It's pointless to disable ping on external connections or internal connections.

 

The only thing to do (which, again, isn't ping specific) is make sure you can't be flooded via it. No modern machine allows the old ICMP-packet attacks, and you can be DoS'd whether or not you bother to reply to a packet or not (you still received it, so it still took up bandwidth etc. whether or not the port was closed or open).

 

Don't listen to the nonsense. There's a reason that, by default, almost every machine and operating system on the planet responds to ping by default.

[Michael]

I'm guessing they have access to the Command Prompt or some form of utility to allow that? I think pinging is probably the least of your worries!

[Davit2005]

It's not normal to allow ping from External connections, most firewalls will block this by default even DrayTek does this out of the box. My home firewall has ping disabled on all interfaces by default.

[ledow2]

It's not normal to allow ping from External connections, most firewalls will block this by default even DrayTek does this out of the box. My home firewall has ping disabled on all interfaces by default.

And you're not offering mail, or web, or any external service whatsoever that also gives away your presence?

 

You can ping your ISP gateway, nameservers, everything on route (anything that responds to traceroute will tend to respond to ping), Google's DNS servers, BBC News, and just about any domain name of a web host you choose.

 

Allow, rate-limit if necessary. Because when you're next outside and trying to see if the school connection is up (e.g. trying to connect from home and having problems with RDP not responding), you know in one packet whether the connection is down, or just the RDP service, for example.

[Davit2005]

And you're not offering mail, or web, or any external service whatsoever that also gives away your presence?

 

You can ping your ISP gateway, nameservers, everything on route (anything that responds to traceroute will tend to respond to ping), Google's DNS servers, BBC News, and just about any domain name of a web host you choose.

 

Allow, rate-limit if necessary. Because when you're next outside and trying to see if the school connection is up (e.g. trying to connect from home and having problems with RDP not responding), you know in one packet whether the connection is down, or just the RDP service, for example.

 

I don't see any reason to allow ping from external to internal servers. If the service is up it's up, what's the use if a website is pingable but doesn't respond to browser requests :-) .

 

Ping is a useful testing feature but it is not fool proof.

Edited April 6, 2017 by Davit2005

[HPlum78]

ICMP Echo in the most part is harmless (ping of death anyone), ping can be used to garner information about your network structure but is not a concern if the server is publicly available (they are public! so visible). You can note how these two well known companies deal with ping on their external www sites google.com will respond where as Microsoft.com wont (what maybe common is not the same as recommend practice). Some of the ICMP packet stuff is used so blocking needs consideration and firewalls are not just about north/ south but east/ west traffic as well, are we still in a time where the only tool in the box is to disable parts of the OS? ok for manage windows clients, but don't help for all those none windows/ none managed devices we now support on our networks (just food for thought).