33

After executing the following to disable ping replies:

# sysctl net.ipv4.icmp_echo_ignore_all=1
# sysctl -p

I obtain different results from pinging localhost vs. 127.0.0.1

# ping -c 3 localhost
PING localhost(localhost (::1)) 56 data bytes
64 bytes from localhost (::1): icmp_seq=1 ttl=64 time=0.029 ms
64 bytes from localhost (::1): icmp_seq=2 ttl=64 time=0.035 ms
64 bytes from localhost (::1): icmp_seq=3 ttl=64 time=0.101 ms

--- localhost ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2042ms
rtt min/avg/max/mdev = 0.047/0.072/0.101/0.022 ms

Pinging 127.0.0.1 fails:

ping -c 3 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.

--- 127.0.0.1 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2032ms

Why are these results different?

Improve this question
0

3 Answers 3

Reset to default
62

The ping command shows the address it resolved the name to. In this case it resolved to the IPv6 localhost address, ::1. On the other hand, 127.0.0.1 is an IPv4 address, so it explicitly makes ping use IPv4.

The sysctl you used only affects IPv4 pings, so you get replies for ::1, but not for 127.0.0.1.

The address you get from resolving localhost depends on how your DNS is resolver is set up. localhost is probably set in /etc/hosts, but in theory you could get it from an actual name server.

As for how to drop IPv6 pings, you may need to look into ip6tables, as there doesn't seem to be a similar sysctl for IPv6. Or just disable IPv6 entirely, if you're not using it in your network. (Though of course that's not a very forward-looking idea, but doable if you're not currently using it anyway.)

Improve this answer
3
  • 2
    IPv6 requires ICMP to not be blocked in order properly to function. ;)
    – zaTricky
    Mar 16, 2018 at 6:17
  • 3
    @zaTricky, the question only mentioned blocking ping. While obnoxious and not very useful, I don't think it should break anything in general. Blocking all ICMP packets would obviously be much worse, but no-one even suggested that, it was only mentioned in the two comments here...
    – ilkkachu
    Mar 16, 2018 at 12:40
  • Granted, could be more specific. "ICMP echo-request", commonly referred to as ping, is required for proper communication over IPv6. You can block spontaneous unwanted ping ingresses to clients - but if you block outbound you're probably breaking IPv6 functionality. Doesn't help that the question seems to have changed since answers were posted.
    – zaTricky
    Mar 20, 2018 at 8:21
34

127.0.0.1:
127.0.0.1 is the default loopback of most system. A loopback address is an address used by the system to validate the network stack of the OS.
The loopback address for IPv4 could take any value in the subnet 127.0.0.0/8
The loopback address for IPv6 could take any value in the subnet ::1/128
ping any value in those range should work if your network stack is working on your OS.

localhost:
localhost is a hostname, this a sort of domain name but local to your own machine.
This hostname by default point to your IPv4 and IPv6 loopback which is often 127.0.0.1 or ::1.

localhost address could be changed easily by editing the file /etc/hosts.
If your system use the service systemd-resolved, this service will handle the way localhost is resolved.
According to the documentation of systemd-resolved:

The hostnames "localhost" and "localhost.localdomain" (as well as any hostname ending in ".localhost" or ".localhost.localdomain") are resolved to the IP addresses 127.0.0.1 and ::1

ping
When you try to ping a hostname or domain name it will ask the OS to resolve this hostname or domain name. In your case, you disabled icmpv4 but localhost is resolved as your IPv6 loopback and your IPv4 loopback but only your IPv6 loopback answer.
The difference is in one case you're trying to ping an IP and in the other case you ping a hostname that could take several values.

Disable icmpv6
If you don't need IPv6 I advise you to disable it. It will double all the work you would need to do on firewall and configuring services: 

sysctl -w net.ipv6.conf.all.disable_ipv6=0

If you still want IPv6 support and want to avoid icmpv6, you could use ip6tables: 

ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
Improve this answer
5
  • 2
    Something is wrong with your hosts file. It should also have ::1 localhost in it.
    – Michael Hampton
    Mar 14, 2018 at 17:04
  • 2
    Side note: remember than in IPv4 the whole 127.0.0.0/8 network are loopback addresses (so ping 127.100.101.102 will work as well).
    – jjmontes
    Mar 14, 2018 at 17:59
  • 1
    Entries for localhost are not necessarily needed in /etc/hosts. For example, systemd-resolved synthesizes DNS resource records for localhost and localhost.localdomain.
    – Johan Myréen
    Mar 14, 2018 at 19:18
  • @MichaelHampton It's not the complete hosts file but I don't have ::1 localhost running ubuntu 17.10
    – Kiwy
    Mar 15, 2018 at 8:37
  • 2
    The "subnet" ::1/128 corresponds to only one IP, much like 127.0.0.1/32 only resolves to that one IP.
    – zaTricky
    Mar 16, 2018 at 6:20
9

Localhost has two addresses, an IPv6 address ::1 and an IPv4 address 127.0.0.1.

IPv6 is the default protocol, so ::1 is always preferred over 127.0.0.1. This is why you have pinged ::1 when asking to ping localhost.

As for why you could ping ::1 but could not ping 127.0.0.1, your sysctl has only disabled pings for IPv4, but not for IPv6. As far as I can tell, there is no corresponding sysctl to disable pings for IPv6, but you can disable it in the firewall instead if you really need to (of course disabling it is not recommended anyway).

Improve this answer
3
  • 5
    Disabling pings for IPv6 is ill advised at it break connectivity, people connecting from teredo address can no longer reach the machine (as it uses the ping to select the closest anycast teredo tunnel machine)
    – Ferrybig
    Mar 14, 2018 at 17:19
  • 1
    The preference of name resolution for IPv6 vs. IPv4 can be controlled with the /etc/gai.conf file. By default, it has only comments. If you uncomment the precedence lines in it and make the change also suggested in the comments, you can get the hostname resolution to prefer IPv4 instead of the default IPv6.
    – telcoM
    Mar 15, 2018 at 13:31
  • @telcoM Yes, you can do that. If you do, though, it's a good idea to give prominent warnings for anyone who might use that machine, as changing the precedence introduces unexpected behavior.
    – Michael Hampton
    Mar 15, 2018 at 15:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .