配置Linux禁止ping和请允许ping

2343图2

生产服务器：
OS: CentOS release 6.8 (Final)
任务：通过内核参数配置ping
一、临时生效配置方式：
不允许本地ping
[sky@sky9896 ~]$ ping  117.40.*.*
PING 117.40.*.* (117.40.*.*) 56(84) bytes of data.
[sky@sky9896 ~]$ ping 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
不允许客户端对本服务器ping
[iyunv@Cacti ~]# ping 117.40.*.*
PING 117.40.*.* (117.40.*.*) 56(84) bytes of data.
操作配置如下：
[sky@sky9896 ~]$ cat /proc/sys/net/ipv4/icmp_echo_ignore_all
1
对1改成0，即可本地ping或客户端对服务器的ping
[iyunv@sky9896 sky]# echo 0 >/proc/sys/net/ipv4/icmp_echo_ignore_all
[iyunv@sky9896 sky]# cat /proc/sys/net/ipv4/icmp_echo_ignore_all   
0
测试效果：
[iyunv@sky9896 sky]# ping 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.057 ms
[iyunv@Cacti ~]# ping 117.40.*.*  #客户端测试ping服务器
PING 117.40.*.* (117.40.*.*) 56(84) bytes of data.
64 bytes from 117.40.*.*: icmp_seq=1 ttl=64 time=0.438 ms
二、永久生效方式：
[iyunv@sky9896 sky]# vi /etc/sysctl.conf
………
net.ipv4.icmp_echo_ignore_all = 0    #允许ping，设1禁止ping
[iyunv@sky9896 sky]# sysctl –p   #使新配置生效