Linux默认是允许Ping响应的，系统是否允许Ping由2个因素决定的：
1）内核参数
2）防火墙
需要2个因素同时允许才能允许Ping，2个因素有任意一个禁Ping就无法Ping。
第一种设置内核参数：
1）允许ping :
a:临时允许PING配置
[root@CCIELAB lszlab]# echo 0 >/proc/sys/net/ipv4/icmp_echo_ignore_all
b:永久允许PING配置
编辑/etc/sysctl.conf 文件 加入 net.ipv4.icmp_echo_ignore_all=0
[root@CCIELAB lszlab]# vi /etc/sysctl.conf
#ping （0表示允许，1表示禁止）
net.ipv4.icmp_echo_ignore_all=0
修改完成使用sysctl -p使其新配置生效
[root@CCIELAB lszlab]# sysctl -p
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
error: "net.bridge.bridge-nf-call-iptables" is an unknown key
error: "net.bridge.bridge-nf-call-arptables" is an unknown key
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
net.ipv4.icmp_echo_ignore_all = 0
2）禁止Ping：
a：临时禁止PING配置：
[root@CCIELAB lszlab]# echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_all
禁止ping 前
[qd01@ip-CentOS-6 ~]$ ping -c 3 192.168.198.141
PING 192.168.198.141 (192.168.198.141) 56(84) bytes of data.
64 bytes from 192.168.198.141: icmp_seq=1 ttl=64 time=0.291 ms
64 bytes from 192.168.198.141: icmp_seq=2 ttl=64 time=0.484 ms
64 bytes from 192.168.198.141: icmp_seq=3 ttl=64 time=0.475 ms
--- 192.168.198.141 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 0.291/0.416/0.484/0.092 ms
禁止ping 后
PING 192.168.198.141 (192.168.198.141) 56(84) bytes of data.
--- 192.168.198.141 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 12002ms
b:永久禁止PING配置
编辑/etc/sysctl.conf 文件 加入 net.ipv4.icmp_echo_ignore_all=1
[root@CCIELAB lszlab]# vi /etc/sysctl.conf
#ping （0表示允许，1表示禁止）
net.ipv4.icmp_echo_ignore_all=1
修改完成使用sysctl -p使其新配置生效
[root@CCIELAB lszlab]# sysctl -p
net.ipv4.ip_forward = 0
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
error: "net.bridge.bridge-nf-call-iptables" is an unknown key
error: "net.bridge.bridge-nf-call-arptables" is an unknown key
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
net.ipv4.icmp_echo_ignore_all = 1
第二种：设置防火墙：
内核配置是默认值，也就是没有禁止Ping下进行设置
1）允许ping 操作
[root@CCIELAB lszlab]# iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
[root@CCIELAB lszlab]# iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
或者临时关闭防火墙：
[root@CCIELAB lszlab]# service iptables stop
iptables: Flushing firewall rules: [ OK ]
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Unloading modules: [ OK ]
2）禁止ping操作
[root@CCIELAB lszlab]# iptables -A INPUT -p icmp --icmp-type 8 -s 0/0 -j DROP
