Updated: 28 September 2026 · Applies to: AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10 (firewalld), Ubuntu 24.04 and 26.04, Debian 13 (sysctl or UFW), servers with CSF
A server answers ping (ICMP echo requests) by default. Some administrators switch this off so the server is less visible to casual scans. It is not real protection: port scanners find open services without ping. It also makes troubleshooting harder for you and for your provider's support, because "does the server answer ping?" is one of the first checks. If you do disable it, consider allowing ping from your own and your provider's monitoring addresses.
Only block echo requests. Other ICMP messages are needed for the network to work properly, for example path MTU discovery, and IPv6 depends on ICMPv6 for basic functions.
Option 1: firewalld (AlmaLinux, Rocky Linux, RHEL)
firewall-cmd --permanent --add-icmp-block=echo-request firewall-cmd --reload
Undo it with --remove-icmp-block=echo-request. To still allow ping from one monitoring address, add a rich rule: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="198.51.100.7" icmp-type name="echo-request" accept'.
Option 2: kernel setting (all distributions)
echo "net.ipv4.icmp_echo_ignore_all = 1" > /etc/sysctl.d/90-no-ping.conf sysctl --system
This ignores all IPv4 pings, whatever the firewall says. Set the value back to 0 to undo. For IPv6 pings, the matching setting is net.ipv6.icmp.echo_ignore_all = 1.
Option 3: UFW (Ubuntu, Debian)
UFW allows ping in /etc/ufw/before.rules. In that file, change the line
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
so that it ends in -j DROP, then run ufw reload.
Option 4: CSF (cPanel servers)
In /etc/csf/csf.conf, set ICMP_IN = "0", then run csf -r.
Check it
From another machine: ping -c 3 203.0.113.10 should now get no replies.
Official documentation: IP sysctl settings (Linux kernel) and firewalld documentation.
