Hack The Sec-Leading Resource Of Linux Tutorial: ICMP

<div dir="ltr" style="text-align: left;" trbidi="on">
Allow/deny,disable or drop/block ping request 
Ping is a computer network administration software utility used to test the reachability of a host on an Internet Protocol (IP) network, and to measure the round-trip time for messages sent from the originating host to a destination computer and echoed back to the source.  
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMkvanWwL3sQ5vslmP9RJn-wN23GzG7XOupgaiHDMQJzpuqMvvq8LlJAZ6Q0fGyREUOXoCHIEyBnFXFWJFq0YlnOGnfGnZmTFBoPHoDn4etpw8Fi6u-G95vqTG-_KDlTEvCd2xtpZxzRHE/s1600/security.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMkvanWwL3sQ5vslmP9RJn-wN23GzG7XOupgaiHDMQJzpuqMvvq8LlJAZ6Q0fGyREUOXoCHIEyBnFXFWJFq0YlnOGnfGnZmTFBoPHoDn4etpw8Fi6u-G95vqTG-_KDlTEvCd2xtpZxzRHE/s1600/security.jpg" /></a></div>
 
The name comes from active sonar terminology that sends a pulse of sound and listens for the echo to detect objects under water,although it is sometimes interpreted as a backronym to packet Internet groper 
Blocking PING on server is helpful sometimes, if the server is continue to face any type of DDoS attack by using the PING feature. By using <a href="http://www.hackthesec.co.in/search/label/Iptables" target="_blank">iptables </a>we can simply stop the PING option. 
STEP : 1 
You can setup kernel variable to drop all ping packets. Type the following command at shell prompt: 
This instructs the kernel to simply ignore all ping requests. 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all</pre>
To enable ping request type the command: 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all</pre>
You can add following line to /etc/sysctl.conf file: 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"># vi /etc/sysctl.conf </pre>
Append following line: 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">net.ipv4.icmp_echo_ignore_all = 1</pre>
Save and close the file. 
STEP : 2 
Also we can manage it by the help of '<a href="http://www.hackthesec.co.in/search/label/Iptables" target="_blank">iptables</a>'. The 'ping' is using ICMP to communicate. We can simply manage the 'icmp : Internet Controlled Message Protocol'from iptables. 
The below pasted switches are required for creating a rule for managing icmp. 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">-A : Add a rule
-D : Delete rule from table
-p : To specify protocol (here 'icmp')
--icmp-type : For specifying type
-J : Jump to target</pre>
Normally using icmp types and its Codes Click here for ICMP Types and Codes 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">echo-request : 8
echo-reply : 0
</pre>
<div>
How to block PING to your server with an error message?</div>
In this way you can partially block the PING with an error message 'Destination Port Unreachable'. Add the following iptables rules to block the PING with an error message. (Use REJECT as Jump to target) 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">iptables -A INPUT -p icmp --icmp-type echo-request -j REJECT</pre>
Result : -  
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">[root@redhat ~]# ping hackthesec.co.in
Pinging hackthesec.co.in [216.239.34.21] with 32 bytes of data:
From 216.239.34.2 icmp_seq=1 Destination Port Unreachable
From 216.239.34.2 icmp_seq=2 Destination Port Unreachable
From 216.239.34.2 icmp_seq=3 Destination Port Unreachable</pre>
To block without any messages use DROP as Jump to target. 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j DROP</pre>
Allow Ping from Outside to Inside 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT</pre>
How to block PING from your server? 
In this way you can block PING option from your server to outside. Add these rules to your iptables to do the same. 
 
Block PING operation with message 'Operation not permitted' 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">iptables -A OUTPUT -p icmp --icmp-type echo-request -j DROP</pre>
Result:- 
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; margin-bottom: 10px; overflow: auto; padding: 9.5px; word-break: break-all; word-wrap: break-word;">root@test [~]# ping google.com
PING google.com (173.194.34.136) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted</pre>
To block with out any error messages 
For this, DROP the echo-reply to the INPUT chain of your iptables. 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">iptables -A OUTPUT -p icmp --icmp-type echo-request -j DROP
iptables -A INPUT -p icmp --icmp-type echo-reply -j DROP</pre>
Allow Ping from Inside to Outside 
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;">iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT</pre>
You can use the icmp code instead of icmp-type name for adding rule to iptables. 
 
<a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></div>