When you deploy a new Linux server onto the public internet, one of the primary ways hackers and automated botnets discover it is by executing massive, automated “ping sweeps” across entire subnets. If your server responds to the ping, the attacker instantly knows the IP address is alive and will immediately begin port-scanning it to find vulnerabilities in your web or SSH services.
By default, almost all Linux distributions are configured to politely reply to these ICMP (Internet Control Message Protocol) echo requests. If you want your server to “go dark” and become invisible to casual network scanners, you must configure your firewall to drop these requests silently. We can achieve this directly at the kernel level using the powerful iptables utility.
Step 1: Check Current Ping Status
Before making any changes, you should verify that your server is currently responding to pings.
- Open a terminal on your local, personal computer (not the server).
- Type
ping <your_server_ip>and press Enter. - You should see a continuous stream of responses (e.g.,
64 bytes from 192.168.1.10: icmp_seq=1 ttl=64 time=12.4 ms). Press Ctrl+C to stop the ping.
Step 2: Drop ICMP Requests Using iptables
We will add a rule to the very front of the firewall’s input chain instructing it to silently discard any incoming ICMP echo requests.
- Log into your Linux server via SSH.
- Execute the following command with root privileges:
sudo iptables -I INPUT -p icmp --icmp-type echo-request -j DROP - Press Enter.
How the command works:
-I INPUTinserts this rule at the absolute top of the incoming traffic chain.-p icmp --icmp-type echo-requestspecifically isolates the exact type of traffic generated by apingcommand, ignoring other vital ICMP traffic (like fragmentation needed messages).-j DROPtells the firewall to delete the packet immediately without sending a rejection notice back to the sender. The attacker’s terminal will simply hang as if the IP address is completely dead.
Step 3: Verify the Rule Works
Return to your local computer’s terminal and run the ping <your_server_ip> command again.
This time, you should receive absolutely no response. The terminal will sit there silently, eventually throwing a “Request timeout” error. Your server is now invisible to standard ping sweeps.
Step 4: Make the iptables Rule Permanent
iptables rules are loaded entirely into RAM. The moment you reboot your server, the rule we just created will be wiped out, and your server will start responding to pings again.
To make the rule survive a reboot, you must save it to a persistent configuration file.
On Ubuntu/Debian:
- Install the persistent package (if it isn’t already):
sudo apt-get install iptables-persistent - Save your current live rules to the hard drive:
sudo netfilter-persistent save
On CentOS/RHEL/AlmaLinux:
- Save the rules directly to the system config file:
sudo iptables-save > /etc/sysconfig/iptables
Your server will now permanently ignore all incoming ping requests, drastically reducing the amount of automated malicious traffic targeting your machine.