linux icmp阻塞,linux – 为什么不阻止ICMP？

我想我的CentOS 5.3系统几乎完成了我的iptables设置.这是我的剧本……

# Establish a clean slate

iptables -P INPUT ACCEPT

iptables -P FORWARD ACCEPT

iptables -P OUTPUT ACCEPT

iptables -F # Flush all rules

iptables -X # Delete all chains

# Disable routing. Drop packets if they reach the end of the chain.

iptables -P FORWARD DROP

# Drop all packets with a bad state

iptables -A INPUT -m state --state INVALID -j DROP

# Accept any packets that have something to do with ones we've sent on outbound

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# Accept any packets coming or going on localhost (this can be very important)

iptables -A INPUT -i lo -j ACCEPT

# Accept ICMP

iptables -A INPUT -p icmp -j ACCEPT

# Allow ssh

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow httpd

iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Allow SSL

iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Block all other traffic

iptables -A INPUT -j DROP

对于上下文,此计算机是虚拟专用服务器Web应用程序主机.

在一个previous question,Lee B说我应该“更多地锁定ICMP”.为什么不完全阻止它？如果我这样做会发生什么(会发生什么坏事)？

如果我不需要阻止ICMP,我怎么能更多地锁定它？