36

I have a series of Ubuntu 10.04 servers and each one has ufw firewall enabled. I have allowed port 22 (for SSH) and 80 (if it's a webserver). My question is that I am trying to enable icmp echo response (ping reply).

ICMP functions differently than other protocols--I know it is below the IP level in a technical sense. You can just type sudo ufw allow 22, but you cannot type sudo ufw allow icmp

6 Answers 6

25

ufw does not allow specifying icmp rules via the command line interface command. It does allow you to adjust your ruleset via its rules files, which are iptables-restore style files.

ufw does allow certain icmp traffic by default including icmp echo reply, and this is already configured by default in /etc/ufw/before.rules:

-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

If your host is not responding to ping, look in this file to make sure the above line is present and if that doesn't work, look at the pinging host and any firewalls between them.

3
  • 3
    not works for me: 11.04 server.how can i troubleshoot this issue?
    – pylover
    Dec 17, 2012 at 20:46
  • Does it need any reset or something like that? Dec 17, 2013 at 20:05
  • 3
    @AmirKarimi sudo ufw reload (and to allow ping requests I had to add -A ufw-before-output -p icmp --icmp-type echo-request -j ACCEPT in /etc/ufw/before.rules)
    – baptx
    Jan 14, 2018 at 20:43
4

For Ubuntu 18.04, you should have the following rules in your /etc/ufw/before.rules file:

# ok icmp codes for INPUT
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type source-quench           -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded           -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem       -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request            -j ACCEPT

# ok icmp code for FORWARD
-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type source-quench           -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type time-exceeded           -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type parameter-problem       -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type echo-request            -j ACCEPT

These were in my default file.

Of course, be sure that this is really the problem. My issue was that my computer was blocking pings from getting out to the network where the server I was trying to ping existed. I ended up using a web site that was already out on the internet to do the ping for me (e.g. https://ping.eu/ping/).

4

Add the following to the /etc/ufw/before.rules file:

# allow outbound icmp
-A ufw-before-output -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A ufw-before-output -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

After editing the file, run the command:

sudo ufw reload
1

It should be noted that, at least in Windows, ping (by default) attempts to communicate via IPv6 and that UFW (by default) blocks that.

In order to ping the IPv4 address, use ping -4 <ip.add.re.ss>

0

Here is a help document that discuesses how to enable/disable ping et al responses.

UFW help

0

If you are still having problems, maybe it is your VirtualBox or VMWare network settings. I often use NAT addressing and so I need to go to Devices/Network/Network Settings... -> Advanced -> Port Forwarding and add a rule to map host to guest ports for port 22.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .