firewalld: 禁止ping和允许ping

一，默认情况允许ping

[lhdop@blog ~]$ ping 8.14.7.5
PING 8.14.7.5 (8.14.7.5) 56(84) bytes of data.
64 bytes from 8.14.7.5: icmp_seq=1 ttl=58 time=2.69 ms
64 bytes from 8.14.7.5: icmp_seq=2 ttl=58 time=2.59 ms
...

二，禁止ping

[root@iZ2zejc9t0hf6pnw6sewrxZ ~]# firewall-cmd --permanent --add-icmp-block=echo-reply
success
[root@iZ2zejc9t0hf6pnw6sewrxZ ~]# firewall-cmd --permanent --add-icmp-block=echo-request
success
[root@iZ2zejc9t0hf6pnw6sewrxZ ~]# firewall-cmd --reload
success

已生效:

[lhdop@blog ~]$ ping 8.14.7.5
PING 8.14.7.5 (8.14.7.5) 56(84) bytes of data.
From 8.14.7.5 icmp_seq=1 Packet filtered
From 8.14.7.5 icmp_seq=2 Packet filtered
...

查看zone配置文件中写入的规则

[root@blog ~]# more /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. 
  Only selected incoming connections are accepted.</description>
  <service name="dhcpv6-client"/>
  <service name="cockpit"/>
  <port port="80" protocol="tcp"/>
  <port port="443" protocol="tcp"/>
  <icmp-block name="echo-reply"/>
  <icmp-block name="echo-request"/>
  ...

三，禁止ping后无任何响应

注意我们上面的命令，禁止ping后仍然会回应Packet filtered
如果想不做任何回应，可以直接对icmp包做drop

[root@blog ~]# firewall-cmd --permanent --add-rich-rule='rule protocol value=icmp drop'
success

查看zone配置文件中写入的规则:

[root@blog ~]# more /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer.
  Only selected incoming connections are accepted.</description>
  <service name="dhcpv6-client"/>
  <service name="cockpit"/>
  <port port="80" protocol="tcp"/>
  <port port="443" protocol="tcp"/>
  <rule>
    <protocol value="icmp"/>
    <drop/>
  </rule>
  ...

测试效果:

[lhdop@blog ~]$ ping 8.14.7.5
PING 8.14.7.5 (8.14.7.5) 56(84) bytes of data.
^C
--- 8.14.7.5 ping statistics ---
9 packets transmitted, 0 received, 100% packet loss, time 203ms

可以看到目标机器没有再响应