Cfrgtkky

I have a series of Ubuntu 10.04 servers and each one has ufw firewall enabled. I have allowed port 22 (for SSH) and 80 (if it's a webserver). My question is that I am trying to enable icmp echo response (ping reply).

ICMP functions differently than other protocols--I know it is below the IP level in a technical sense. You can just type sudo ufw allow 22, but you cannot type sudo ufw allow icmp

ufw does not allow specifying icmp rules via the command line interface command. It does allow you to adjust your ruleset via its rules files, which are iptables-restore style files.

ufw does allow certain icmp traffic by default including icmp echo reply, and this is already configured by default in /etc/ufw/before.rules:

-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

If your host is not responding to ping, look in this file to make sure the above line is present and if that doesn't work, look at the pinging host and any firewalls between them.

For Ubuntu 18.04, you should have the following rules in your /etc/ufw/before.rules file:

# ok icmp codes for INPUT

-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT

-A ufw-before-input -p icmp --icmp-type source-quench           -j ACCEPT

-A ufw-before-input -p icmp --icmp-type time-exceeded           -j ACCEPT

-A ufw-before-input -p icmp --icmp-type parameter-problem       -j ACCEPT

-A ufw-before-input -p icmp --icmp-type echo-request            -j ACCEPT



# ok icmp code for FORWARD

-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT

-A ufw-before-forward -p icmp --icmp-type source-quench           -j ACCEPT

-A ufw-before-forward -p icmp --icmp-type time-exceeded           -j ACCEPT

-A ufw-before-forward -p icmp --icmp-type parameter-problem       -j ACCEPT

-A ufw-before-forward -p icmp --icmp-type echo-request            -j ACCEPT

These were in my default file.

Of course, be sure that this is really the problem. My issue was that my computer was blocking pings from getting out to the network where the server I was trying to ping existed. I ended up using a web site that was already out on the internet to do the ping for me (e.g. https://ping.eu/ping/).

Here is a help document that discuesses how to enable/disable ping et al responses.

UFW help

Add the following to the /etc/ufw/before.rules file:

# allow outbound icmp

-A ufw-before-output -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

-A ufw-before-output -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

After editing the file, run the command:

sudo ufw reload