up vote 10 down vote favorite
7

I feel like this should be a really simple thing to do, but googling and checking SF I didn't see anything. I'm trying to make my Fedora server not respond to pings, how do I do that?

share|improve this question

closed as off-topic by kasperd, Ward, Jim B, fuero, mdpc May 3 '16 at 20:29

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – kasperd, Ward, Jim B, fuero, mdpc
If this question can be reworded to fit the rules in the help center, please edit the question.
    
This article explains how to do this. – Sam Cogan Jul 28 '09 at 21:58
    
Additionally, you can use "Blackhole" security: the server simply won't answer connection attemps to closed ports, so portscan becomes a difficult one ;) – kolypto Jul 28 '09 at 22:46
9  
I've never understood the advantages of disabling ICMP Echo Requests on servers. It makes monitoring and debugging network connectivity troublesome. Servers will usually have one or more low ports open for service anyway, so it's not like you can blackhole them. Could you let me know your reason, please? – Martijn Heemels Sep 4 '09 at 13:21
2  
It's done only for a false sense of security. – Michael Hampton♦ Mar 6 '13 at 10:15
up vote 22 down vote accepted

To disable the PING response, add the following line to your init script for the network:

echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_all

To reenable the PING response do this:

echo 0 >/proc/sys/net/ipv4/icmp_echo_ignore_all

Update:

To make the change permanent add the following line to /etc/sysctl.conf:

net.ipv4.icmp_echo_ignore_all=1
share|improve this answer
    
how can i do it for windows server family?? – AminM Mar 5 '14 at 15:21
up vote 11 down vote

Add the following line to /etc/sysctl.conf:

net.ipv4.icmp_echo_ignore_all=1

It has the same effect as the above echo lines.

share|improve this answer
up vote 11 down vote

It is better to use firewall for these purposes, so that you can optionally enable ping from some systems, esp monitoring systems

iptables -t filter -I INPUT -p icmp --icmp-type echo-request -s monitoring_system -j ACCEPT
iptables -t filter -I INPUT -p icmp --icmp-type echo-request -j DROP
share|improve this answer
4  
+1 For selective enabling – Josh Brower Jul 29 '09 at 23:30
3  
Just in case it's not obvious to iptables newbies, replace "monitoring_system" with the IP/range of the server(s) which should be able to ping the server. All other ping requests will be silenty dropped. – Coops Jul 30 '09 at 8:40
up vote 1 down vote

You can also use this command to disable ping request

sysctl net.ipv4.icmp_echo_ignore_all=1

To enable it again 

sysctl net.ipv4.icmp_echo_ignore_all=0

Finally save it sysctl -p

share|improve this answer
1  
Weird, the opposite works on my system with Ubuntu 14.04. I am pinging localhost if it matters. – Elijah Lynn Jul 1 '15 at 3:04
1  
Sorry! I recheked now and corrected. Tried in CentOS 7. – Sathish Jul 2 '15 at 16:57
    
Great, thanks for confirming I wasn't crazy! – Elijah Lynn Jul 2 '15 at 17:04
up vote 0 down vote

Just do this:

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
share|improve this answer
up vote 0 down vote

open your /etc/sysctl.conf and append this line

net.ipv4.icmp_echo_ignore_all = 1

and execute this command

sysctl -p

it's still usable after reboot

share|improve this answer
up vote -1 down vote

Firewall block ICMP connections.

especially icmp echo.

share|improve this answer
7  
However, do not block all ICMP traffic because this will e.g. break Path MTU discovery. – knweiss Jul 28 '09 at 22:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.