Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It it possible for a PC behind a NAT ping to a device that is on the outside of the NAT and get a successful response? (assuming the firewall permits it)

This is a Cisco RV 120W router

share|improve this question
Possible? Yes. Possible with that model? Don't know. Have you tried? – John Gardeniers Jan 14 '11 at 21:35
Have not tried, would be awkward to try as none of our routers permit pings and this one was not functioning properly to begin with. All resolved now. The answer is yes (with this model) @John – George Bailey Feb 7 '11 at 22:07
up vote 3 down vote accepted

I don't see why not as long as the router/firewall allows outbound ICMP and the inbound responses.

share|improve this answer
bear in mind that icmp doesn't have ports so while you can have a server behind the nat for every external ip:port combination, you could only ping 1 server for each external ip – JamesRyan Jan 14 '11 at 19:35
@JR: I don't follow... – joeqwerty Jan 14 '11 at 19:42
@Joe - ICMP is its own protocol under IP, just like TCP is also a protocol under IP. You can only forward the protocol (or not) to a host inside the NAT, unlike the way that you can forward different TCP ports to different inside hosts. – mfinni Jan 14 '11 at 20:51
@mfinni, that would certainly be a problem for pings directed to a target behind NAT but is not a factor for the source being behind NAT. I'm pretty sure we've all quite successfully pinged remote targets from behind NAT. I know I do so regularly. – John Gardeniers Jan 14 '11 at 21:33
@John - of course. I was answering Joe's "i don't follow" directed at @JamesRyan, which was a deviation from the original question. – mfinni Jan 14 '11 at 21:46

It is quite possible, the router just has to allow it. I don't know that specific router though.

share|improve this answer

The ICMP protocol has to be allowed though the routing devices.

If you have some doubt, you can run the traceroute (Linux) or tracert (Windows) command, to see up to which device the ICMP protocol is allowed.

  tracer[ou]t[e] IPaddressOrDomain

While you see

  IP/Domain  time1 time2 time3

the protocol goes through.
But when you see a series of (or infinite)

  * * *

the protocol is dropped/blocked or a device on the way back prevents the protocol to be routed.

share|improve this answer
Not so. The **** means that THAT device doesn't RESPOND to ICMP traffic, it does not meant that device BLOCKS ICMP traffic. – joeqwerty Jan 14 '11 at 18:53

Yes. As long as the router allows the Ping request to pass outbound and properly tracks the request so that it can return. Most routers I have dealt with handle this correctly. Pings in though a Firewall (NAT or not) are often blocked.

There are tools which manipulate TCP packets to generate ICMP failures to provide the equivalent functionality through a Firewall.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.