Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

and stealth specific ports?

share|improve this question
add comment

4 Answers

up vote 6 down vote accepted

To deny responses to ping requests..Add the following iptable rule

iptables -A OUTPUT -p icmp -o eth0 -j ACCEPT          
iptables -A INPUT -p icmp --icmp-type echo-reply -s 0/0 -i eth0 -j ACCEPT     
iptables -A INPUT -p icmp --icmp-type destination-unreachable -s 0/0 -i eth0 -j ACCEPT  
iptables -A INPUT -p icmp --icmp-type time-exceeded -s 0/0 -i eth0 -j ACCEPT       
iptables -A INPUT -p icmp -i eth0 -j DROP       
share|improve this answer
    
something is wrong with the rules or i just don't have dependencies, i changed the eth0 to wlan0 as i am on my laptop right now, and received the error "sudo iptables -A INPUT -p icmp –icmp-type destination-unreachable -s 0/0 -i wlan0 -j ACCEPT Bad argument –icmp-type'" and "sudo iptables -A INPUT -p icmp -i wlan0-j DROP Bad argument DROP'" –  david25 Dec 15 '10 at 10:38
    
@david25 see my updated answer. –  karthick87 Dec 15 '10 at 10:48
    
it worked :) thx. –  david25 Dec 15 '10 at 11:17
add comment

I believe iptables -I INPUT -p icmp --icmp-type 8 -j DROP should do the trick.

For IPv6 you would need something like ip6tables -I INPUT -p icmpv6 --icmp-type 8 -j DROP.

share|improve this answer
add comment

Drop ICMP echo requests ("Ping"):

iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

What do you mean by stealth? You could just DROP all incoming packets. Google provided this:

iptables -A INPUT -p tcp -m stealth -j REJECT

But on (my) Ubuntu box, iptables does not know of a "stealth" match. As it seems, you can do lots of interesting stuff with xtables:

aptitude show xtables-addons-common
share|improve this answer
add comment

Simplest method of disabling ping response is to add an entry in /etc/sysctl.conf file. If the Iptables flushes or stop server will start responding to ping responses again. I suggest the following entry in your /etc/sysctl.conf file

net.ipv4.icmp_echo_ignore_all = 1

this will tell kernel to not respond any ping response, after this run sysctl -p on shell to implement the changes without reboot.

For more info please refer: http://www.trickylinux.net/disable-ping-response-linux/

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.