Working from my Arch Console (having not yet installed Openbox), I've installed firewalld, sudo pacman -S firewalld, then, to check that it's overall working, firewall-cmd --panic-on correctly blocks my ping -c 3 But is it specifically working for my LAN port enp0s25? When I configure like this:

sudo firewall-cmd --set-default-zone=drop
sudo firewall-cmd --zone=drop --change-interface=enp0s25
firewall-cmd --zone=drop --add-rich-rule='rule family="ipv4" source address="" reject'

(The last line thanks to Hitesh Jethva.) I can still get a ping from Why, and is there a way from the Console to check that firewalld is working for my interface?


From my understanding you want to block ping towards, so that is not source address, it's destination address. You could use rich rules to configure it if there are many IPs that change often.

Generally speaking, you can block ICMP like this:

firewall-cmd --zone=public --add-icmp-block={echo-request,echo-reply,timestamp-reply,timestamp-request} --permanent 

firewall-cmd --reload

You can also use pre-defined lists of IPs/objects. See here how.

  • Nope, that icmp-block didn't stop the pings in for my interface in zone drop, and neither did setting source address="" reject in my rich rule block ping archlinux.org... – JosephHarriott Mar 27 at 8:07
  • Neither could I block pacman -S wget, nor wget https://wiki.archlinux.org/index.php/Wget... – JosephHarriott Mar 27 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.