I used this command iptables -A INPUT -p icmp --icmp-type echo-request -j DROP to block the ping packets my computer receives, however the ping google.com command still starts getting ping packages from Google.

  • 1
    I am not sure I understand your question. Do you execute ping google.com? If you do, that does not mean that google.com is pinging you, but you are pinging google.com. And that is OK, because you drop INPUT icmp, which are incoming pings. However, with ping command you are issuing outgoing pings, which are not blocked. If there is a method to make google.com ping you, that would be new for me. – nobody Dec 23 '20 at 13:52

Your iptables rule is blocking external echo-requests to your system, but still receiving echo-replies. When you ping google.com, your system sends echo-request to google.com (which is allowed) and then google.com responds with echo-replies to your system (which is also allowed).

In your current situation, you can block echo-replies by adding one more INPUT rule.

$ sudo iptables -A INPUT -p icmp --icmp-type echo-reply -j DROP

Another different approach, is to block your system from sending echo-requests and echo-replies by using the OUTPUT chain instead.

$ sudo iptables -A OUTPUT -p icmp --icmp-type echo-request -j DROP
$ sudo iptables -A OUTPUT -p icmp --icmp-type echo-reply -j DROP

Three possible things that can play here:

First, you drop packets of type "echo-request", those are what your ping program sends. The reply you get from the remote is "echo-reply", you didn't block them.

Some low-level ways of sending raw packets actually bypass iptables. I think I remember at least the ISC DHCP server/client working even if iptables is set to drop DHCP packets. (At least the client needs to be able to send packets with the zero address as the source since it doesn't have an address yet when it starts.) If I'm not mistaken, that would be AF_PACKET (see packet(7)), but the ping tool on my Debian doesn't use that, and does obey iptables.

Third, since you used -A to append to the INPUT chain, you might have something there before it that makes the new rule ineffective, depending on how your iptables is set up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.