21

I have a series of Ubuntu 10.04 servers and each one has ufw firewall enabled. I have allowed port 22 (for SSH) and 80 (if it's a webserver). My question is that I am trying to enable icmp echo response (ping reply).

ICMP functions differently than other protocols--I know it is below the IP level in a technical sense. You can just type sudo ufw allow 22, but you cannot type sudo ufw allow icmp

17

ufw does not allow specifying icmp rules via the command line interface command. It does allow you to adjust your ruleset via its rules files, which are iptables-restore style files.

ufw does allow certain icmp traffic by default including icmp echo reply, and this is already configured by default in /etc/ufw/before.rules:

-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

If your host is not responding to ping, look in this file to make sure the above line is present and if that doesn't work, look at the pinging host and any firewalls between them.

  • 3
    not works for me: 11.04 server.how can i troubleshoot this issue? – pylover Dec 17 '12 at 20:46
  • Does it need any reset or something like that? – Amir Karimi Dec 17 '13 at 20:05
  • 1
    @AmirKarimi sudo ufw reload (and to allow ping requests I had to add -A ufw-before-output -p icmp --icmp-type echo-request -j ACCEPT in /etc/ufw/before.rules) – baptx Jan 14 '18 at 20:43
2

For Ubuntu 18.04, you should have the following rules in your /etc/ufw/before.rules file:

# ok icmp codes for INPUT
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type source-quench           -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded           -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem       -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request            -j ACCEPT

# ok icmp code for FORWARD
-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type source-quench           -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type time-exceeded           -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type parameter-problem       -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type echo-request            -j ACCEPT

These were in my default file.

Of course, be sure that this is really the problem. My issue was that my computer was blocking pings from getting out to the network where the server I was trying to ping existed. I ended up using a web site that was already out on the internet to do the ping for me (e.g. https://ping.eu/ping/).

0

Here is a help document that discuesses how to enable/disable ping et al responses.

UFW help

0

Add the following to the /etc/ufw/before.rules file:

# allow outbound icmp
-A ufw-before-output -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A ufw-before-output -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

After editing the file, run the command:

sudo ufw reload

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.