How to Allow Ping to Your VPS from an External IP

This guide shows you how to configure your VPS firewall and system settings to respond to ICMP echo requests (ping) from external IP addresses. By default, many VPS providers and operating systems block ping for security, so you’ll learn the exact commands to enable it on common Linux distributions. You’ll need root or sudo access to your VPS and a basic familiarity with the command line.

What You’ll Need

• Root or sudo access to your VPS (via SSH)
• Your VPS’s operating system (Ubuntu/Debian, CentOS/RHEL, or other Linux)
• Knowledge of whether your provider has a separate cloud firewall (e.g., in the provider’s control panel)

Step-by-Step

1. Log in to your VPS via SSH. Use your terminal (Linux/macOS) or PuTTY (Windows) to connect: ssh user@your_vps_ip. Replace user with your username and your_vps_ip with your server’s public IP.
2. Identify your firewall tool. Most modern VPS use ufw (Ubuntu/Debian), firewalld (CentOS/RHEL), or iptables directly. Run sudo ufw status or sudo firewall-cmd --state to see which is active. If neither is installed, you may be using plain iptables.
3. Allow ICMP echo requests via ufw (if using ufw). Run sudo ufw allow icmp or more specifically sudo ufw allow proto icmp from any to any. This opens all ICMP types, but you can restrict to echo-request with sudo ufw allow proto icmp icmp-type echo-request.
4. Allow ICMP via firewalld (if using firewalld). Run sudo firewall-cmd --permanent --add-icmp-block-inversion (this allows all ICMP types) or sudo firewall-cmd --permanent --add-icmp-block=echo-request (this blocks echo-request, so instead use --remove-icmp-block=echo-request). After changes, reload with sudo firewall-cmd --reload.
5. Allow ICMP via iptables (if using iptables directly). Run sudo iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT. To make it persistent, save with sudo netfilter-persistent save (Debian/Ubuntu) or sudo service iptables save (RHEL/CentOS).
6. Check your VPS provider’s cloud firewall. Many providers (DigitalOcean, AWS, Azure, etc.) have a separate firewall in their control panel. Log into your provider’s dashboard, find your VPS, and ensure there’s an inbound rule allowing ICMP (or ping) from the desired IP or from anywhere (0.0.0.0/0). If you skip this, your server may still block ping.
7. Test locally first. From your VPS, run ping -c 4 127.0.0.1 to confirm the kernel responds. Then try pinging your VPS’s public IP from your local machine. If it fails, proceed to troubleshooting.

Common Mistakes

• Forgetting the provider firewall. The most common issue is that the VPS’s internal firewall is configured, but the provider’s cloud firewall still blocks ICMP. Always check both.
• Allowing all ICMP types vs. only echo-request. Some guides suggest allowing all ICMP, which is fine for testing but less secure. Restricting to echo-request is safer.
• Not reloading firewalld. If you use firewalld and forget to run sudo firewall-cmd --reload, changes won’t take effect.
• Using the wrong interface. If you have multiple network interfaces, ensure you’re adding the rule to the correct one (e.g., eth0 vs. ens3).
• Not saving iptables rules. Without saving, rules are lost after reboot.

Tips

• For security, allow ping only from specific IPs or subnets if you don’t need it from anywhere. Use sudo ufw allow from 203.0.113.0/24 proto icmp for ufw, or sudo iptables -A INPUT -s 203.0.113.0/24 -p icmp --icmp-type echo-request -j ACCEPT.
• To test without changing firewall rules, temporarily disable the firewall (not recommended for production) or use a tool like tcping to test TCP connectivity instead.
• If you’re using a cloud provider like AWS, you can use Security Groups to allow ICMP; for Azure, use Network Security Groups (NSG).
• Consider using rate limiting on ICMP to prevent abuse: sudo iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/second -j ACCEPT.

Troubleshooting

If ping still doesn’t work after following the steps:

1. Check the provider firewall again. Log into your provider’s dashboard and verify the inbound ICMP rule is active. Sometimes rules are not applied until you save or reboot.
2. Test from the VPS itself. Run ping -c 4 your_vps_public_ip from the VPS. If that fails, the issue is local. If it works, the issue is external (provider firewall or your local network).
3. Check if the kernel is ignoring ICMP. Run sysctl net.ipv4.icmp_echo_ignore_all. If it returns 1, set it to 0 with sudo sysctl -w net.ipv4.icmp_echo_ignore_all=0 and make it permanent by adding net.ipv4.icmp_echo_ignore_all=0 to /etc/sysctl.conf.
4. Verify iptables rules are in the right chain. Use sudo iptables -L -n -v to see if your rule is present and the packet count is increasing when you ping. If not, the packet is being dropped before reaching your rule (maybe by a default DROP policy).
5. Check for other security software. Some VPS have fail2ban or other intrusion prevention that may block ICMP. Check logs with sudo journalctl -u fail2ban or sudo tail /var/log/syslog.
6. Reboot the VPS. Sometimes a reboot applies firewall changes cleanly, especially after iptables saves.

Frequently Asked Questions

Why is ping blocked by default on my VPS?

Many VPS providers and operating systems block ICMP to reduce the attack surface and prevent network reconnaissance. It’s a common security hardening step.

Is it safe to allow ping from anywhere?

Generally yes, but it reveals that your server is active and responsive. If you’re concerned, restrict ping to specific IPs or subnets.

What is the difference between ICMP and TCP ping?

ICMP ping uses the ICMP protocol (echo request/reply). TCP ping uses TCP packets (e.g., to port 80) to check if a service is up. Firewalls often block ICMP but allow TCP, so TCP ping may work when ICMP ping fails.

Do I need to allow both IPv4 and IPv6 ping?

If your VPS has an IPv6 address, you’ll need to configure both. For ufw, use sudo ufw allow proto ipv6-icmp; for iptables, use ip6tables commands.

How can I test ping from an external network without a second device?

You can use online ping tools (like ping.eu) that send ICMP requests from their servers. Just enter your VPS IP and see if they get a response.

Will allowing ping affect my VPS performance?

Minimally. Ping requests are small and low-volume. However, if you’re under a DDoS attack, ICMP can be used to amplify traffic, so consider rate limiting.

Related

• MacBook Touch Bar Not Showing? Fixes That Work
• Thermostat Batteries Dead: What Happens & What to Do
• Recover Call Logs from Sony Xperia: Full Guide