How the Linux firewall disables pinging

Generally in order to host security and other factors, we will prohibit the host is ping test, this method of prohibition is more, the following methods are their own practice in the process of summarizing the experience, in this record to make learning notes.

1, in the context of server security we will prohibit some default ports, in the input chain of the filter table set the default rule to drop, and then you need the relevant ports and services to open.

iptables  -t filter   -p input   drop      #默认规则的设置   You need to be aware of remote port rules when setting this rule [[Email protected] ~]# iptables -lchain input   (Policy drop) target     prot opt source                destination          ACCEPT     tcp  --  anywhere              anywhere             tcp dpt:mysql ACCEPT     tcp   --  anywhere              anywhere            tcp dpt:ssh  This is the command to check ping  ping  192.168.31.84ping 192.168.31.84  (192.168.31.84)  56 ( bytes of data.   #结果是不通的   When the default rule is changed to open or open the ICMP protocol, it will be able to ping.  1, open the ICMP protocol and ping through iptables  -t filter -i input  -p icmp   -j  ACCEPT ping  192.168.31.84PING 192.168.31.84  (192.168.31.84)  56 ( bytes of data.64 bytes from 192.168.31.84: icmp_seq=100 ) ttl=128 time=0.605 ms64 bytes from 192.168.31.84: icmp_seq=101 ttl=128  time=0.736 ms64 bytes from 192.168.31.84: icmp_seq=102 ttl=128 time= 0.754 ms64 bytes from 192.168.31.84: icmp_seq=103 ttl=128 time=0.696  Ms

The above setting the default rules for the way of refusal, not only can not let others ping, at the same time they can not ping the other host, this way we use less, we can take the following way,

echo "net.ipv4.icmp_echo_ignore_all=1" >>/etc/sysctl.conf [[email protected] ~]# tail-1/etc/sysctl.conf Net.ip V4.icmp_echo_ignore_all=1[[email protected] ~]# sysctl-p When we test, we will find that we can ping other hosts, but other hosts can not ping through,

The following approach is that we will allow ping to be placed in front of the firewall rules and according to the firewall rule priority level, not allow ping to be placed behind

This article is from the "Keep Dreaming" blog, please be sure to keep this source http://dreamlinux.blog.51cto.com/9079323/1859177

How the Linux firewall disables pinging