配置Linux禁止ping和请允许ping

生产服务器：

OS: CentOS release 6.8 (Final)

任务：通过内核参数配置ping

一、临时生效配置方式：

不允许本地ping

[[email protected] ~]$ ping  117.40.*.*

PING 117.40.*.* (117.40.*.*) 56(84) bytes of data.

[[email protected] ~]$ ping 127.0.0.1

PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.

不允许客户端对本服务器ping

[[email protected] ~]# ping 117.40.*.*

PING 117.40.*.* (117.40.*.*) 56(84) bytes of data.

操作配置如下：

[[email protected] ~]$ cat /proc/sys/net/ipv4/icmp_echo_ignore_all

1

对1改成0，即可本地ping或客户端对服务器的ping

[[email protected] sky]# echo 0 >/proc/sys/net/ipv4/icmp_echo_ignore_all

[[email protected] sky]# cat /proc/sys/net/ipv4/icmp_echo_ignore_all

0

测试效果：

[[email protected] sky]# ping 127.0.0.1

PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.

64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.057 ms

[[email protected] ~]# ping 117.40.*.*  #客户端测试ping服务器

PING 117.40.*.* (117.40.*.*) 56(84) bytes of data.

64 bytes from 117.40.*.*: icmp_seq=1 ttl=64 time=0.438 ms

二、永久生效方式：

[[email protected] sky]# vi /etc/sysctl.conf

………

net.ipv4.icmp_echo_ignore_all = 0    #允许ping，设1禁止ping

[[email protected] sky]# sysctl –p   #使新配置生效