We have a server running CentOS 7. There is a weird situation where I can ping to the server from my firewall but was not able to perform a traceroute. The server is a directly connecting to the firewall, so by right, when I do a traceroute from my firewall, it should see 1 hop which is the server ip, but currently traceroute fails. Understand that in Windows, there is a Windows firewall which controls the inbound and outbound connection. May I know is there a same in linux? I have googled around and mostly all are about ping, ssh, http, https services but none talked about traceroute. Please advise. Thanks.


  • Make sure that ICMP messages are passed on. Ping and tracert(traceroute) depend on it. Your question looks like the ping-type can pass and the tracert-type is blocked. – zx485 Apr 11 at 19:52

Your setup is unclear a bit, so I will try to cover this topic widely.

Depends on router software your traceroute can be ICMP or UDP. I just have tested that there is nothing special firewalld requires to get ICMP traceroute enabled. (You can try this from any windows host). Usually it works when ping works.

So I assume your tries are of UDP traceroute type.

To make UDP traceroute work you should first discover what policy is the default in the corresponding zone. Traceroute send UDP packets and get something in return - for destination host it can be either:

  1. ICMP packet "port unreachable" which is default kernel behavior (like when you have no firewall at all or firewalld with ACCEPT policy).
  2. ICMP packet "host unreachable" which is default firewalld behavior with REJECT policy.
  3. Nothing, which is default for firewalld DROP policy.

Different software react in different way. For example, Linux traceroute show both port-unr and host-unr in traceroute output:

3  test.la.ru (  0.848 ms !X  0.838 ms !X  0.837 ms !X

Note !X here - that means host had sent host-unr and my traceroute do not know if destination is behind that hop or not. It just know trace stops here.

3  test.la.ru (  0.700 ms  0.695 ms  0.688 ms

Here we have port-unr, my traceroute now know that it have reached the destination host and this is normal traceroute output.

I made this explanation to understand that certain routers (like Cisco switches) do not accept host-unr replies and will not show destination host which is answering host-unr (firewalld default) and you may be wrong thinking there are some filtration of output packets. To make sure what really happens you have to run tcpdump on your server.

Anyway, to make UDP traceroute work as expected for both Cisco and Linux you need to open UDP ports in public zone (or other zone if your config is more complicated)

firewall-cmd --zone=public --add-port=33434–33534/udp

Unfortunately, CentOS 7 seem to have no port range option in firewall-cmd, so you have to add them by one.

You can also try this in bash:

firewall-cmd --zone=public --add-port={33434..33534}/udp
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.