To make a VPS answer an external ping, allow the request through both firewalls that can filter it: your hosting provider’s VPC firewall or security group, and the firewall inside the VPS. Ping uses ICMP for IPv4 (protocol 1) or ICMPv6 for IPv6 (protocol 58), so there is no TCP or UDP port to open. A public IP address by itself does not bypass a deny rule.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Start with a narrow source range—ideally the fixed address used by your monitoring service—then test from a host that is genuinely outside the provider’s private network. If the test still times out, counters and logs at each layer show where the packet stopped.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What must be allowed for an external ping
An echo request travels through several independent controls before the VPS can answer. Treat them as gates rather than as one universal firewall setting.
- Address and route: the VPS must have the public IPv4 or IPv6 address you are testing, and that address must route to the instance.
- Provider network policy: a VPC firewall, security group, or cloud firewall must allow inbound ICMP or ICMPv6 from the tester’s source range.
- Guest firewall: nftables, UFW, firewalld, or another host firewall must accept echo requests before a later drop rule.
- Kernel and return path: the operating system must be willing to answer and must have a route back to the tester.
SSH working proves only that TCP port 22 (or your chosen SSH port) passed these checks. It does not imply that ICMP is permitted.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Identify the protocol, address family, and source
IPv4 versus IPv6
For an IPv4 address, select ICMP (IP protocol 1). For an IPv6 address, select ICMPv6 (IP protocol 58). Cloud consoles often present these as separate choices, and a rule for one family does not automatically permit the other.
Ping has no destination port
ICMP echo requests are not TCP or UDP traffic. Do not create a rule for port 7, port 22, or another service port when your goal is ping. Choose an ICMP protocol or an explicit echo-request type.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Use the tester’s public source range
Record the public address seen by the VPS provider, not the tester’s private LAN address. A single fixed tester can be expressed as a /32 IPv4 CIDR or a /128 IPv6 CIDR. If a monitoring service publishes a stable block, allow that block instead. Google Cloud documentation distinguishes IPv4 and IPv6 source ranges and notes that 0.0.0.0/0 permits every IPv4 source; the IPv6 equivalent is ::/0.
Prepare before changing a rule
- Confirm the VPS’s current public IPv4 and, if applicable, public IPv6 address in the provider console and on the guest.
- Write down the tester’s public IPv4 or IPv6 address and the family you will test first.
- Identify whether the provider uses a VPC firewall, security group, network ACL, or a combination.
- Identify the guest firewall frontend and whether its configuration is persisted across reboot.
- Keep an existing SSH session open while editing rules so a mistake does not remove your recovery path.
- Decide whether ping is for a short diagnostic or continuous monitoring; a continuous check normally justifies a fixed, narrow source CIDR.
Add the provider-side ingress rule
Create an inbound or ingress allow rule that targets the VPS. Set the protocol to ICMP for IPv4 or ICMPv6 for IPv6, and set the source to the smallest CIDR that contains the external tester. Some platforms target instances by network tag, label, interface, or security-group membership; select the mechanism attached to this VPS rather than granting the rule to an unrelated network.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Place the rule where the provider will evaluate it before a broader deny, if that platform uses ordered rules. If the platform is stateful, the echo reply is normally allowed as return traffic once the request is accepted; still verify the platform’s documented behavior and counters.
Google Cloud example
Google Cloud’s documented pattern is an ingress rule with action ALLOW, protocol icmp, and a restricted --source-ranges value. A command following that pattern is:
gcloud compute firewall-rules create allow-icmp-monitoring --direction=INGRESS --action=ALLOW --rules=icmp --source-ranges=203.0.113.4/32 --network=defaultReplace the example CIDR and network with the tester and VPC you actually use. If the instance is selected by a network tag, add the tag targeting option used by your deployment. For IPv6, create the provider’s ICMPv6 rule and supply an IPv6 source range; do not assume the IPv4 rule covers it. Google’s default network documentation describes a default-allow-icmp rule that allows tools such as ping, but custom networks or modified defaults may not have that rule.
Google Cloud’s firewall guidance states: “As a best practice, specify the specific IP address ranges that you need to allow access from, rather than all IPv4 or IPv6 sources.” Treat 0.0.0.0/0 or ::/0 as a temporary diagnostic choice, not a permanent monitoring policy.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
OpenStack
OpenStack security groups deny unmatched inbound traffic by default. Add an ICMP rule to the security group attached to the instance:
openstack security group rule create --protocol icmp SECURITY_GROUPReplace SECURITY_GROUP with the group name or ID. Where your deployment supports it, limit the rule to the tester’s CIDR or reference another security group instead of allowing every source. Check that the group is attached to the correct port or server and that any additional network policy does not override it.
Amazon EC2
In an EC2 security group, add an inbound rule for ICMP. AWS describes ping as ICMP traffic and requires an inbound ICMP security-group rule. For IPv4, choose an ICMP rule such as Echo Request (or the platform’s all-ICMP option) and set the source CIDR. For IPv6, add the corresponding ICMPv6 rule and IPv6 source range. Keep the source restricted to the addresses that will actually probe the instance.
What to record for any provider
| Setting | IPv4 | IPv6 |
|---|---|---|
| Protocol | ICMP (protocol 1) | ICMPv6 (protocol 58) |
| Port | None | None |
| Source | Tester’s IPv4 CIDR, such as a /32 | Tester’s IPv6 CIDR, such as a /128 |
| Target | VPS interface, tag, network, or security group | VPS IPv6-enabled interface or equivalent target |
| Verification | Provider rule logs and counters, then an external IPv4 ping | Separate ICMPv6 logs and an external IPv6 ping |
Allow echo requests in the VPS firewall
nftables
The nftables rule must match an echo request and appear before a later drop rule in the input chain. On a system with an existing inet filter input chain, the following rules illustrate the required matches and add counters for troubleshooting:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
sudo nft add rule inet filter input icmp type echo-request counter accept
sudo nft add rule inet filter input icmpv6 type echo-request counter acceptIf the chain is ordered and already ends with a drop, insert the accept rule at the appropriate earlier position rather than appending it after the drop. The exact table and chain names vary, so inspect the active ruleset first:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11sudo nft list rulesetAfter confirming the test works, save the rules using the persistence method supplied by your Linux distribution. A command entered interactively can disappear at reboot. If you rate-limit echo requests, ensure the limit still permits the frequency used by your monitor.
The nftables documentation notes that accepting icmp-echo-request is useful for diagnostics but “also lets probes discover this host is alive.” That is the principal security trade-off: ping reveals liveness and can generate probe traffic, although it does not expose a TCP service by itself.
UFW, firewalld, and other frontends
If the host is managed by UFW, firewalld, a vendor firewall agent, or orchestration software, create the equivalent ICMP echo-request allowance in that frontend rather than editing nftables underneath it. Confirm that the frontend supports separate IPv4 and IPv6 handling, place the rule ahead of its final deny policy, and use its documented save or reload operation so the rule survives a reboot. Avoid maintaining conflicting rules in two frontends; one may overwrite the other.
Kernel and policy checks
If an nftables counter increases but no reply leaves the host, inspect for a later drop, a restrictive kernel ICMP setting, or a routing problem. Verify that the address family you permitted is the one being tested. An IPv4 request cannot be answered by an IPv6-only rule, and vice versa.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsTest from a genuinely external network
- From a host outside the VPS provider’s private network, run
ping VPS_PUBLIC_IPfor IPv4 or the platform’s IPv6 ping form for an IPv6 address. - Confirm that the destination printed by the tool is the VPS’s current public address, not a private address or an old allocation.
- Run the test after the provider rule is active, then again after the guest rule is active; this separates the two gates.
- Watch the provider firewall log or rule counter while sending several requests.
- Watch the guest rule counter at the same time. A successful test should increment the matching echo-request rule and produce replies at the tester.
Testing from another machine inside the same VPC can give a misleading result because private traffic may follow different policy. Conversely, an external ISP, corporate network, or transit provider can block ICMP before it reaches your cloud, so use a second independent external network when necessary.
Troubleshoot by locating the first missing counter
| Observation | Most likely location of the block | Next check |
|---|---|---|
| No packet or counter at the provider | Cloud firewall, security group, public-IP association, or upstream network | Verify the rule target, source CIDR, address family, public address, and provider logs. |
| Provider sees the request, but the host counter stays at zero | Packet is not reaching the guest interface, or the wrong address/family is being tested | Check the VPS interface address, route, interface attachment, and IPv4 versus IPv6 selection. |
| Host counter increments, but no reply reaches the tester | A later drop rule, kernel ICMP setting, return-route problem, or family mismatch | Inspect rule order, kernel policy, routing, and the reply path. |
| IPv4 works and IPv6 fails | Missing ICMPv6 rule or IPv6 source-range policy | Create and verify a separate provider and guest ICMPv6 allowance. |
| Ping works briefly, then stops after reboot | Guest rule was not persisted | Save the frontend-managed configuration and test after a controlled reboot. |
Least-privilege and operational safeguards
- Prefer fixed sources: allow a monitoring service’s documented CIDR or your known administration address instead of the entire Internet.
- Separate families: maintain distinct IPv4 and IPv6 rules so an unexpected IPv6 path does not silently broaden access.
- Use counters and logs: enable provider logging where available and retain nftables counters long enough to diagnose intermittent tests.
- Limit exposure deliberately: allowing echo requests advertises that the address is alive. If liveness disclosure is unacceptable, leave ICMP blocked and use an authenticated application-level health check instead.
- Remove temporary rules: delete a broad diagnostic rule after testing and replace it with the narrow CIDR required for ongoing monitoring.
- Automate safely: express the provider rule and guest rule in your infrastructure or configuration-management system, review the rendered order, and apply changes with an existing out-of-band recovery method.
Provider capability comparison
The practical differences between providers are less about the ping packet itself and more about how clearly each platform exposes policy and diagnostics.
| Capability | Google Cloud | OpenStack | Amazon EC2 |
|---|---|---|---|
| Direct ICMP selection | Ingress firewall rule with icmp; IPv6 handled separately |
Security-group rule with --protocol icmp |
Inbound security-group ICMP rule |
| Source restriction | Source ranges, including separate IPv4 and IPv6 ranges | Deployment-dependent CIDR or security-group reference | Security-group source CIDR |
| Default behavior | Depends on network and existing rules; documented default networks may include default-allow-icmp |
Unmatched inbound traffic is denied by default | Requires an inbound ICMP security-group rule for ping |
| Diagnostics | Firewall logs and rule evaluation tools, when enabled | Security-group and port attachment checks | Security-group and instance-network checks |
| Guest firewall | Still independent; the operating system must accept echo requests. | ||
When you should not enable public ping
Ping is useful for reachability tests, path monitoring, and quick diagnosis, but it is not an uptime guarantee for an application. A host can answer ICMP while its web server, database, disk, or authentication layer is failing. Conversely, a healthy host can appear down when an intermediate network filters ICMP. Decide whether your monitor needs network-layer reachability, service-layer health, or both.
If your monitoring provider’s source changes frequently, a permanently broad rule may be the wrong solution. Use an authenticated health endpoint, a private monitoring path, or a provider-supported managed check instead of allowing every Internet address. Keep SSH and application rules independent; enabling ping does not make those services safer or less safe.
Recommended Free Tools
Quick Recap
Quick implementation checklist
- Choose the public address family you will test.
- Identify the tester’s public CIDR.
- Create a provider ingress allow rule for ICMP or ICMPv6 targeted at this VPS.
- Create the matching guest echo-request accept rule before the guest firewall’s drop policy.
- Persist the guest configuration.
- Test from outside the provider’s private network.
- Compare provider and host counters if the request times out.
- Narrow or remove any temporary all-source rule.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
