How to Deny Responses to Ping Requests Using iptables

By | July 16, 2008

Sometimes you need to “hide” your server by denying responses to ping requests. This way your server will look like it is offline. ping <server_ip> will return connection timeout. There is a short linux command that will allow to do this using iptables. Here it is:

iptables -t filter -A INPUT -p icmp -j REJECT

This will ignore icmp packets send to your server (these packets are used to ping your server). You can also deny traffic send using any other protocol instead of icmp by modifying the command, changing icmp to the protocol name you need.

Another solution was found on Linuxquestions.org. It allows outgoing ICMP packets and blocks incoming. Here it is:

/sbin/iptables -A OUTPUT -p icmp -o eth0 -j ACCEPT
/sbin/iptables -A INPUT -p icmp –icmp-type echo-reply -s 0/0 -i eth0 -j ACCEPT
/sbin/iptables -A INPUT -p icmp –icmp-type destination-unreachable -s 0/0 -i eth0 -j ACCEPT
/sbin/iptables -A INPUT -p icmp –icmp-type time-exceeded -s 0/0 -i eth0 -j ACCEPT
/sbin/iptables -A INPUT -p icmp -i eth0 -j DROP