I feel like this should be a really simple thing to do, but googling and checking SF I didn't see anything. I'm trying to make my Fedora server not respond to pings, how do I do that?
4
-
This article explains how to do this.– Sam CoganCommented Jul 28, 2009 at 21:58
-
Additionally, you can use "Blackhole" security: the server simply won't answer connection attemps to closed ports, so portscan becomes a difficult one ;)– kolyptoCommented Jul 28, 2009 at 22:46
-
11I've never understood the advantages of disabling ICMP Echo Requests on servers. It makes monitoring and debugging network connectivity troublesome. Servers will usually have one or more low ports open for service anyway, so it's not like you can blackhole them. Could you let me know your reason, please?– Martijn HeemelsCommented Sep 4, 2009 at 13:21
-
3It's done only for a false sense of security.– Michael HamptonCommented Mar 6, 2013 at 10:15
Add a comment
|
7 Answers
To disable the PING response, add the following line to your init script for the network:
echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_all
To reenable the PING response do this:
echo 0 >/proc/sys/net/ipv4/icmp_echo_ignore_all
Update:
To make the change permanent add the following line to /etc/sysctl.conf:
net.ipv4.icmp_echo_ignore_all=1
It is better to use firewall for these purposes, so that you can optionally enable ping from some systems, esp monitoring systems
iptables -t filter -I INPUT -p icmp --icmp-type echo-request -s monitoring_system -j ACCEPT
iptables -t filter -I INPUT -p icmp --icmp-type echo-request -j DROP
answered Jul 29, 2009 at 9:04
-
3Just in case it's not obvious to iptables newbies, replace "monitoring_system" with the IP/range of the server(s) which should be able to ping the server. All other ping requests will be silenty dropped.– CoopsCommented Jul 30, 2009 at 8:40
Add the following line to /etc/sysctl.conf:
net.ipv4.icmp_echo_ignore_all=1
It has the same effect as the above echo lines.
You can also use this command to disable ping request
sysctl net.ipv4.icmp_echo_ignore_all=1
To enable it again
sysctl net.ipv4.icmp_echo_ignore_all=0
Finally save it sysctl -p
-
1Weird, the opposite works on my system with Ubuntu 14.04. I am pinging localhost if it matters. Commented Jul 1, 2015 at 3:04
-
1
Just do this:
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
open your /etc/sysctl.conf and append this line
net.ipv4.icmp_echo_ignore_all = 1
and execute this command
sysctl -p
it's still usable after reboot
Firewall block ICMP connections.
especially icmp echo.
answered Jul 28, 2009 at 22:01
-
7However, do not block all ICMP traffic because this will e.g. break Path MTU discovery.– knweissCommented Jul 28, 2009 at 22:08