我想在我的 Ubuntu 18.04 上禁用 IPv4/6 ping echo reply。对于 IPv4，我可以使用来
完成。net.ipv4.icmp_echo_ignore_all=1/etc/sysctl.conf
IPv6 的等效版本是什么？
这是我的ip6tables -nvL：
root@localhost:~# sudo ip6tables -nvL
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1990 130K ufw6-before-logging-input all * * ::/0 ::/0
1990 130K ufw6-before-input all * * ::/0 ::/0
0 0 ufw6-after-input all * * ::/0 ::/0
0 0 ufw6-after-logging-input all * * ::/0 ::/0
0 0 ufw6-reject-input all * * ::/0 ::/0
0 0 ufw6-track-input all * * ::/0 ::/0
0 0 DROP icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ufw6-before-logging-forward all * * ::/0 ::/0
0 0 ufw6-before-forward all * * ::/0 ::/0
0 0 ufw6-after-forward all * * ::/0 ::/0
0 0 ufw6-after-logging-forward all * * ::/0 ::/0
0 0 ufw6-reject-forward all * * ::/0 ::/0
0 0 ufw6-track-forward all * * ::/0 ::/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
283 21372 ufw6-before-logging-output all * * ::/0 ::/0
283 21372 ufw6-before-output all * * ::/0 ::/0
39 3884 ufw6-after-output all * * ::/0 ::/0
39 3884 ufw6-after-logging-output all * * ::/0 ::/0
39 3884 ufw6-reject-output all * * ::/0 ::/0
39 3884 ufw6-track-output all * * ::/0 ::/0
Chain ufw6-after-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:137
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:138
0 0 ufw6-skip-to-policy-input tcp * * ::/0 ::/0 tcp dpt:139
0 0 ufw6-skip-to-policy-input tcp * * ::/0 ::/0 tcp dpt:445
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:546
0 0 ufw6-skip-to-policy-input udp * * ::/0 ::/0 udp dpt:547
Chain ufw6-after-logging-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-logging-input (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw6-after-logging-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-after-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-forward (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all * * ::/0 ::/0 rt type:0
0 0 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ufw6-user-forward all * * ::/0 ::/0
Chain ufw6-before-input (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all lo * ::/0 ::/0
0 0 DROP all * * ::/0 ::/0 rt type:0
14 1152 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ufw6-logging-deny all * * ::/0 ::/0 ctstate INVALID
0 0 DROP all * * ::/0 ::/0 ctstate INVALID
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
4 320 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 133 HL match HL == 255
89 5696 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 134 HL match HL == 255
6 432 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 135 HL match HL == 255
11 704 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 136 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 141 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 142 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 130
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 131
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 132
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 143
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 148 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 149 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 151 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 152 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 153 HL match HL == 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 144
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 145
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 146
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 147
0 0 ACCEPT udp * * fe80::/10 fe80::/10 udp spt:547 dpt:546
0 0 ACCEPT udp * * ::/0 ff02::fb udp dpt:5353
0 0 ACCEPT udp * * ::/0 ff02::f udp dpt:1900
0 0 ufw6-user-input all * * ::/0 ::/0
Chain ufw6-before-logging-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-logging-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-logging-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-before-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * lo ::/0 ::/0
0 0 DROP all * * ::/0 ::/0 rt type:0
16 1280 ACCEPT all * * ::/0 ::/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 1
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 2
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 3
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 4
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 128
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 129
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 133 HL match HL == 255
6 384 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 136 HL match HL == 255
11 792 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 135 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 134 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 141 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 142 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 130
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 131
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 132
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 143
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 148 HL match HL == 255
0 0 ACCEPT icmpv6 * * ::/0 ::/0 ipv6-icmptype 149 HL match HL == 255
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 151 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 152 HL match HL == 1
0 0 ACCEPT icmpv6 * * fe80::/10 ::/0 ipv6-icmptype 153 HL match HL == 1
2 192 ufw6-user-output all * * ::/0 ::/0
Chain ufw6-logging-allow (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "
Chain ufw6-logging-deny (1 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all * * ::/0 ::/0 ctstate INVALID limit: avg 3/min burst 10
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw6-reject-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-reject-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-reject-output (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-skip-to-policy-forward (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-skip-to-policy-input (6 references)
pkts bytes target prot opt in out source destination
0 0 DROP all * * ::/0 ::/0
Chain ufw6-skip-to-policy-output (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-track-forward (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp * * ::/0 ::/0 ctstate NEW
0 0 ACCEPT udp * * ::/0 ::/0 ctstate NEW
Chain ufw6-track-input (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-track-output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp * * ::/0 ::/0 ctstate NEW
2 192 ACCEPT udp * * ::/0 ::/0 ctstate NEW
Chain ufw6-user-forward (1 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-input (1 references)
pkts bytes target prot opt in out source destination
.....
.....
.....
Chain ufw6-user-limit (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all * * ::/0 ::/0 limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
0 0 REJECT all * * ::/0 ::/0 reject-with icmp6-port-unreachable
Chain ufw6-user-limit-accept (0 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all * * ::/0 ::/0
Chain ufw6-user-logging-forward (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-logging-input (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-logging-output (0 references)
pkts bytes target prot opt in out source destination
Chain ufw6-user-output (1 references)
pkts bytes target prot opt in out source destination
答案1
因为您使用 ufw，所以您必须编辑文件 /etc/ufw/before6.rules 并添加一行：
-A ufw6-before-input -p icmpv6 --icmpv6-type echo-request -j DROP
然后sudo service ufw restart
对于“clean ip6tables”解决方案：
sudo ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP
它将忽略每个回显请求数据包。但请注意，VPS 提供商可能会使用回显请求/回显回复来确定您的服务器是否正在运行。