2

How to DROP icmp requests with firewalld?

An equivalent example instead using iptables would be:

$ iptables -A INPUT --protocol icmp --in-interface enp0s8 -j DROP

The above produces the desired result (no response) like so:

[root@lexy1 ~]# ping l2 PING lexy2.example.vm (192.168.57.102) 56(84) bytes of data.

I'm able to block icmp requests with firewalld using something like:

$ firewall-cmd --zone=internal --add-icmp-block={echo-request,echo-reply}

However ping returns output like so:

[root@lexy1 ~]# ping l2 PING lexy2.example.vm (192.168.57.102) 56(84) bytes of data. From lexy2.example.vm (192.168.57.102) icmp_seq=1 Destination Host Prohibited From lexy2.example.vm (192.168.57.102) icmp_seq=2 Destination Host Prohibited From lexy2.example.vm (192.168.57.102) icmp_seq=3 Destination Host Prohibited

Ping should receive no indication that a server exists at this address. (This is not an attempt at security by obscurity).

  • 2
    It seems to me that you have to create a new zone whose policy is DROP, then you can set icmp-block-inversion; then ICMP traffic matching that zone will be dropped. reference, quoting: "To enable inverting the ICMP Filter, click the Invert Filter check box on the right. Only marked ICMP types are now accepted, all other are rejected. In a zone using the DROP target, they are dropped." – Jeff Schaller Jul 14 '17 at 19:54
  • Thanks @JeffSchaller, that works. I just moved the interface to the predefined drop zone, added the services I need on that interface, and ran $ firewall-cmd --permanent --zone=drop --add-icmp-block-inversion. If you answer, I will accept. – Alxs Jul 15 '17 at 11:25
  • 2
    A slightly quicker way might be to just change the target of the current zone to DROP, assuming there's only the one desired interface in the current zone. Like this: $ firewall-cmd --permanent [--zone=zone] --set-target=DROP. As all services would already have been configured for the current zone you'd just need to add the 'icmp block inversion'. – Alxs Jul 15 '17 at 11:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.