firewall-cmd --permanent --add-rich-rule='rule protocol value=icmp drop' https://zhuanlan.zhihu.com/p/23519454