1

I'd like to have either the public adapter or public IP address on a web-facing server configured to not reply to ping requests.

I have an openvpn tap/tun adapter which I'd like to still respond to ping requests.

So far I've only found methods to disable responses to all ping requests, or to disable responses to ping requests from a specific IP address.

Does anyone know if this is possible, and how I'd go about it?

I'm running ubuntu 16.04 if that's useful information.

Thanks in advance!

  • If you use iptables like firewall you can add this rule iptables -A INPUT -i eth1 -p icmp -j DROP This rule will deny only ping on eth1 interfce. If you wish i can make answer with all needed rules for iptables but you must say me witch port you wish to stay open from internet. – 2707974 May 23 '17 at 7:29
  • Rule for specific ip is iptables -A INPUT -p icmp -d <your_ip_address> -j DROP. – 2707974 May 23 '17 at 7:32
  • Thanks for the reply! At the moment I only have tcp v4 ports 22, 80 and 1194 running services. – Scottmeup May 23 '17 at 7:55
0

Let's start

Delete curent rules and chains

sudo iptables --flush
sudo iptables --delete-chain

allow loopback

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

drop ICMP

sudo iptables -A INPUT -p icmp -d <your_ip_address> -j DROP

or/and

sudo iptables -A INPUT -i eth1 -p icmp -j DROP

or

sudo iptables -A OUTPUT -p icmp -j DROP

allow PING for rest

sudo iptables -A INPUT -p icmp --icmp-type any -j ACCEPT

allow established connections

sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

allow SSH

sudo iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

allow HTTP

sudo iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

allow OpenVPN

sudo iptables -A INPUT -m state --state NEW -m udp -p udp --dport 1194 -j ACCEPT

default policies

sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT ACCEPT

Save

sudo iptables-save

This is it. I think :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.