How to set up servers to filter and deny ICMP ECHO (ping) packets?

Code:

/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
/bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

iptables -A INPUT -p icmp -s 0/0 --icmp-type echo-request -j DROP
iptables -A INPUT -p udp --dport 33434:33524 -j DROP

cPanel.net Support Ticket Number:

 

If you are running Freebsd you can do the blackhole thing. We were getting hammered with closed port icmp traffic at 200+ hits per second. Do:

sysctl -w inet.net.udp.blackhole=1
sysctl -w inet.net.tcp.blackhole=2

this really f-cks up alot of port scanners and other icmp hacker/DDOS tools.

Be careful though as some programs might not like the TCP blackhole, but experiment with them, it cant kill your system.



cPanel.net Support Ticket Number: