Comments on: How to Block Ping ICMP Requests to Linux Systems

By: Robert

Robert — Wed, 22 Jul 2020 12:48:20 +0000

In the latest set of command it should be “--add-icmp-block“, NOT “--remove-icmp-block“. See for details: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-managing_icmp_requests

By: Matei Cezar

Matei Cezar — Mon, 29 Jan 2018 08:09:41 +0000

The guide just shows how you can disable ICMP for certain cases, but not implies that you must disable it.

By: Anders Lowinger

Anders Lowinger — Thu, 25 Jan 2018 17:11:02 +0000

This is just a BAD recommendation. You should not block ICMP, it disables Path MTU discovery which gives poor performance for people on links with less than 1500 bytes MTU. PPPoE is one such link.

If you want to filter, rate limit ICMP to 10 packets/sek or similar.

By: Out

Out — Wed, 24 Jan 2018 16:10:32 +0000

What the stupid thing to remove icmp protocol. This move not security improve, but networking maybe slow down (to this host).

By: Jonix

Jonix — Wed, 24 Jan 2018 12:44:10 +0000

Also, before adding the solution in /etc/sysctl.conf, check that file for eventual other places the definitions are/is set (on my system it was in /usr/lib/sysctl.d/50-default.conf )