How to block the ICMP from Elastic IP


Hello there, I have some Public IPs connected to Nat Gateway mapped to private ip address. NAC-ACL is created to block the ICMP but i notice the trace route to public ip is enable. May i know the best approach to block the ICMP protocol to public ip.

   Appreciate your help in resolving this issue as we have been raised the concern by security team to block the ICMP protocal.
1 Answer


This page details the rules that you have to include in the security group of your VPC to allow / block ICMP / ping traffic traffic:

All details re. ICMP and ping:

This page is also interesting:



profile pictureAWS
answered 4 months ago
  • I checked the urls and block the ICMP on private ip by creating the security group also denied on from network ACL but still i can able to trace the route from public ip and looking to block it. Also checked it with unused public ip i can able to traceroute the IP which make me suspecious.

  • What is the OS ?

    As per the Wikipedia page that @Didier_Durand advised reading:

    On Unix-like operating systems, traceroute sends, by default, a sequence of User Datagram Protocol (UDP) packets, with destination port numbers ranging from 33434 to 33534

    See this Red Hat document as well (even if you may not be running RHEL it is still useful)

    On a typical *nix system it uses UDP and sends traffic to port 33434 by default.

  • Hi, as emphasized by Steve_M, traceroute is UDP while ping is ICMP: UDP & ICPM are different IP protocoles authorized by different rules in a secgroup. So, traceroute working doesn't mean ping will work.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions