Respond to Internet ICMP (Ping) Set on 2.5.1.8?

tomschmidt
Virtuoso
Mar 17, 2020
CrimpOn, I am also running v2.5.1.8 and respond to ping is unchecked. Yet if I ping my WAN IP address it answers a ping. I checked it and repeated the test, still answers ping. Uncheck again and it still answers ping. These pings are not logged in the routers logs, but yes, this can contribute to more DDOS attempts.

Do you have Dynamic DNS enabled? I disabled DDNS, but pings are still being answered even though it should not be answering them. The config value shows it is disabled.

root@RBR50:/# config show | grep -i ping
wan_endis_rspToPing=0
ookla_averageping=0

If I enable it in the web GUI, then wan_endis_rspToPing=1 as it should.

So then I wondered if my cable modem is answering the ping, not the router. So I unplugged the cable between my modem and router and run a ping from my cell phone on LTE and my WAN IP still answers. Therefore the modem is answering this ping, not the router. I logged into my modem and the settings are configured by my ISP, nothing that I can set to disable it from answering a ping. I may have to contact them to have them disable answering ping on the modem, or if that is even supported.
- CrimpOn
  Guru - Experienced User
  Mar 17, 2020
  tomschmidt wrote:
  Do you have Dynamic DNS enabled? I disabled DDNS, but pings are still being answered even though it should not be answering them. The config value shows it is disabled.
  I do have DDNS enabled. For a test, I disabled it and the "Respond" box remains grayed out.
  
  So then I wondered if my cable modem is answering the ping, not the router. So I unplugged the cable between my modem and router and run a ping from my cell phone on LTE and my WAN IP still answers.
  With everybody "sheltering", I will have to plan a time to unplug the Orbi to make this test.
  As an alternate test, I did a debug capture and had ShieldsUP! scan my IP. The WAN capture file clearly shows the ping come in and a ping response go back. The capture file says the response is from my IP adddress and has the MAC address of my Orbi WAN port.
  
  The capture file has a lot of traffic from dynupdate.no-ip.com, but none of these packets are ICMP.
  
  Thanks for the thoughtful response.
  - bkeith4web
    Guide
    Sep 05, 2020
    CrimpOnI was working on my OpenVPN today on a RBR40 with the latest firmware (2.5.1.16 I think) and ran into a weird respond to ping issue. I know about enabling the VPN resetting the 'respond to ping' config switch and how to set it with telnet. But even when set to zero, GRC shields up (and my own internet ping from my phone) still showed an internet ping response. I unplugged the router from my (comcast) cable modem based on this thread to see if was the router or the cable modem responding. The ping response stopped, so it was the Orbi router. Plugged it back in and voila, still no ping response (like it should have been all along).
    
    The Orbi re-acquired the same IP address from comcast as it had before (they do a pass-through so my router actually gets an IP address from Comcast DHCP server, not from my cable modem which is owned by me, not leased/rented) but no longer responded to pings from the internet. I didn't make any changes on the Orbi, just unplugged and re-plugged the wan ethernet cable.
    
    I don't understand why this would be, and don't know if I got a new DHCP lease from comcast or was re-assigned the old one, but that's what happened. Maybe another data point that might be helpful for you. Good luck with your trouble-shooting!

Forum Discussion

Respond to Internet ICMP (Ping) Set on 2.5.1.8?