Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have a series of Ubuntu 10.04 servers and each one has ufw firewall enabled. I have allowed port 22 (for SSH) and 80 (if it's a webserver). My question is that I am trying to enable icmp echo response (ping reply).

ICMP functions differently than other protocols--I know it is below the IP level in a technical sense. You can just type sudo ufw allow 22, but you cannot type sudo ufw allow icmp

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

ufw does not allow specifying icmp rules via the command line interface command. It does allow you to adjust your ruleset via its rules files, which are iptables-restore style files.

ufw does allow certain icmp traffic by default including icmp echo reply, and this is already configured by default in /etc/ufw/before.rules:

-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

If your host is not responding to ping, look in this file to make sure the above line is present and if that doesn't work, look at the pinging host and any firewalls between them.

share|improve this answer
1  
not works for me: 11.04 server.how can i troubleshoot this issue? –  pylover Dec 17 '12 at 20:46
    
Does it need any reset or something like that? –  A. Karimi Dec 17 '13 at 20:05
add comment

Here is a help document that discuesses how to enable/disable ping et al responses.

UFW help

share|improve this answer
add comment

As noted, UFW allows ping requests by default. To enable (icmp) ping you need to edit /etc/ufw/before.rules. Find the following lines, and change ACCEPT to DROP:

# ok icmp codes
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

I was wondering though, since you mentioned you have a series of Ubuntu servers and you are manually accessing the UFW on each one, have you considered using an Ubuntu firewall management solution like this one? I understand it can simplify things in your scenario, because it manages the firewalls on all the Ubuntu instances automatically with a central UI. It is similar to GUFW but is more suited to a scenario with multiple servers.

share|improve this answer
    
I have all of those rules, yet my KVM host is still blocking all ICMP requests to guests... –  Cerin Mar 1 at 19:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.