How to Disable Ping ( TCP ) in Linux all the time? [closed]

Question

I want to disable ping response all the time. I use the following command for disable ICMP ping

iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

what should I do for disable TCP ping ?

Answer 1

TCP "ping" is just a fancy name for some programs/a method which (ab)uses the TCP protocol to probe if a port listening in that TCP service number is open.

So, if providing a service for the Internet at large, such as a Web/HTTP Service, there is no way to block that TCP port on particular from answering, if it is listening, or otherwise it will break the inner workings of the TCP/IP protocol.

For a service for restricted/your team use, you can do port knocking to hide it. see Allow SSH access after port knocking from any source IP for an example.

What you can do however, for not having machines scanning all your TCP/IP ports close/open state with success, is creating rules for only allowing incoming connections for your needed services, and DROP the connections to all other TCP ports.

It is important that packets are DROP(ed) and not REJECT(ed). See Is it better to set -j REJECT or -j DROP in iptables?

As for ignoring/dropping ICMP ping requests for the server itself, it makes more sense doing it at kernel level, see How to Disable Ping Response ( ICMP echo ) in Linux all the time?

For further details about the TCP protocol, I advise the reference book "TCP/IP Illustrated, the protocols" 2nd edition, Stevens et al. https://en.wikipedia.org/wiki/TCP/IP_Illustrated

P.S. Needless to say, the best security is not having services open to the Internet at large, in the first place.

Proper enforcing of DMZ - frontend/backend infrastructures, and planning properly a network infrastructure goes a long way. Including security features such as firewall and enforcing VPN use for remote access.