0

Update: It turns out, our in-house network suppresses pings. I demonstrated this by turning my phone into a hot-spot (thus changing my outbound gateway), connecting with a laptop, then pinging the servers, which worked as expected. ::pulls hair out::


I've inherited two Ubuntu servers that seem to be configured to reject PING requests. My goal is to re-enable pinging for diagnostic purposes.

Things I've tried to enable pinging:

Based on instructions from here, I executed this command:

echo  0  > /proc/sys/net/ipv4/icmp_echo_ignore_all

Then added the following instruction to /etc/sysctl.conf so it's enabled on boo. This instruction was not already present:

net.ipv4.icmp_echo_ignore_all=0

ufw

Respecting ufw, I followed the steps noted in this SO thread: In the file /etc/ufw/sysctl.conf, I found this rule. I did not have to add it.

net/ipv4/icmp_echo_ignore_all=0

I also added rules to /etc/ufw/before.rules

-A ufw-before-input -p icmp --icmp-type echo-request -m state --state ESTABLISHED -j ACCEPT

and /etc/ufw/before6.rules

-A ufw6-before-input -p icmpv6 --icmpv6-type echo-request -m state --state ESTABLISHED -j ACCEPT

Then restarted that service. service ufw restart


iptables

I added some iptables entries I found by Googling. (I'm showing only the relevant rules in the list.)

root@tatooine:~# iptables --list
ACCEPT     icmp --  anywhere             maskedpath.linode.com icmp echo-request state NEW,RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            state NEW icmp echo-request

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     icmp --  maskedpath.linode.com  anywhere            icmp echo-reply state RELATED,ESTABLISHED

So my question is: In order to enable pinging, are there additional configurations I am not checking? Alternately, could the ufw rules be loading from a different file? (And if so how can I find that file?)

Thanks in advance for any help!

  • Have you tried to turn off UFW and then ping, and then flush your up tables and then ping? – user508889 Mar 31 '16 at 18:53
  • Thanks @Brian. Yep I tried disabling both ufw and iptables briefly too fully rule them out, but it didn't make a difference. I just updated the question to reflect this but, apparently our in-house network here filters pings. So the servers probably responded to pinging all along. O.o – elrobis Mar 31 '16 at 19:16
1

Hops (Firewalls) along the route could filter icmp packets in between ping source and ping destination.

  • Use mtr / traceroute instead of ping (or Ping next hop then after next hop...)
  • Ping different destination and see if this works
  • Ping from different source network
  • +1 to give you some rep--but my goal is to enable pinging. Note the first bold words in the post :) – elrobis Mar 31 '16 at 13:26
  • 1
    thanks for the rep - hadnt expect it for "comment" - did you try ping next hop? maybe some hop filters icmp? – cybea Mar 31 '16 at 16:42
  • next guess (I don't use ufw): '-s' means source but it should be your external ip address right? So maybe remove source option or change it to your external ip. Hope that helps – cybea Mar 31 '16 at 16:52
  • I remove the -s argument as you suggested and restarted ufw but it still doesn't ping. Also, I edited my question to represent the removed -s option. – elrobis Mar 31 '16 at 18:42
  • Hey fella--your remark maybe some hop filters icmp? caused me to consider if I could ping them from a different network. Using my phone as a hot-spot, I was able to ping them as I would expect. ..at that point I tried pinging www.cnn.com from my office system, no dice. So the culpret, apparently, is our in-house setup. I'll go ahead and accept your answer. Would you mind editing your answer to include your thoughts about questioning other hops along the route--just so it's more obvious to anyone else who might pass through here? – elrobis Mar 31 '16 at 19:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.