UFW: Allow ping requests only for specific host

I just stumbled on this 4 month old question. It really should be listed on a different StackExchange (such as ServerFault), but sometimes even a developer needs to configure a firewall. As it is, I'm here with an answer for you.

For your firewall rules, you'll want to accept packets from your safe IPs first and then drop the rest. Here's how I did it:

Let's assume you only want to accept one safe IP for pings and that IP address is '127.0.0.1'. Of course, this IP could be any address you want (just create more rules or define subnets for additional addresses).

Step 1

First thing is to check is the following in /etc/ufw/sysctl.conf

net/ipv4/icmp_echo_ignore_all=1 

...should be rewritten as with a 0 if it is not already...

net/ipv4/icmp_echo_ignore_all=0 

Step 2

Add rules for IPv4 into /etc/ufw/before.rules

-A ufw-before-input -p icmp --icmp-type echo-request -s 127.0.0.1 -m state --state ESTABLISHED -j ACCEPT 

Step 3 (for IPv6 support)

Add rules for IPv6 into /etc/ufw/before6.rules

-A ufw6-before-input -p icmpv6 --icmpv6-type echo-request -s 127.0.0.1 -m state --state ESTABLISHED -j ACCEPT 

Step 4

Now, restart your firewall and drink a beverage of your choice.

service ufw restart