How can I enable Ping on an Azure Linux VM, Centos 6.6 - I know we can enable this on a Windows VM, but how to do this for a Linux VM?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Ping external address from Azure VM - does not work as Azure does not permit outbound ICMP
Ping Azure VM from external address - does not work as Azure does not permit inbound ICMP
Ping between Azure VMs using internal IP (DIP) - works, but guest OS firewall must be configured to allow it as by default ICMP is blocked by the guest.
Ping between Azure VM and on-premises through Azure Connect (point-to-point IPSec VPN tunnel) or Virtual Network Gateway (site-to-site IPSec VPN tunnel) - works, but guest OS firewall must be configured to allow it as by default ICMP is blocked by the guest.
As an alternative to ping with ICMP, you can verify connectivity by trying to reach a specific TCP port with tools such as TCPing, PortQuery, or NMap. Those will working inbound to an Azure VM as long as you have opened an endpoint for the port you are trying to reach, and the guest firewall allows it and something is listening on that port. For Azure Connect and Virtual Network Gateways you don't need the endpoints because you are communicating through a VPN tunnel, but the guest firewall would still need to allow the port you are testing, and something needs to be listening on that port.
Azure blocks by default ICMP traffic using Network Security groups. To enable you need to create a special rule allowing. For security reasons Azure not allow ICMP from internet
Some examples about how to do:
Nothing is required to enable ping replies which happens by default.
If there is no ICMP (ping) replies coming from the target host, it actually means that they get blocked somewhere along the way. This could happen at any point in either direction, but is mostly happening on your VM's firewall.
You should therefore confirm the VM's firewall is blocking the ping by disabling it. If that works, you just reactivate it and add a rule to allow it.
If disabling the VM's firewall does still not provide ICMP requests to be answered, you should use
tracert on Windows) to see up until what point you get replies and investigate the two hops prior to your VM's IP. It would likely be blocked by your VM's host firewall at that point.
After some research I was able to get this working with the following PS oneliner command.
Get-AzureRmNetworkSecurityGroup -Name "nsgName" -ResourceGroupName "GroupName" | Add-AzureRmNetworkSecurityRuleConfig -Name "AllowPing" -Description "Allow Ping" -Access "Allow" -Protocol "*" -Direction "Inbound" -Priority 40002 -SourceAddressPrefix "*" -SourcePortRange "*" -DestinationAddressPrefix "*" -DestinationPortRange "*" | Set-AzureRmNetworkSecurityGroup
You can get ping inbound by allowing port 0 in a NSG rule.
Get-AzureRmNetworkSecurityGroup -Name "nsgName" -ResourceGroupName "GroupName" | Add-AzureRmNetworkSecurityRuleConfig -Name "AllowPing" -Description "Allow Ping" -Access "Allow" -Protocol "*" -Direction "Inbound" -Priority 40002 -SourceAddressPrefix "*" -SourcePortRange "*" -DestinationAddressPrefix "*" -DestinationPortRange "0" | Set-AzureRmNetworkSecurityGroup
I was able to ping out-of-the-box from an Azure VM running Ubuntu 18 LTS, but I cannot ping from an external location to the VM.
I looked around and inbound ICMP ping requests are disabled by Azure. They are considering enabling it--or at least allowing one to enable it from their portal under "Networking"