1

One of my Proxmox VMs running Ubuntu 13.04 won't accept incoming trace routes while ufw is enabled.

What command do give ufw to allow incoming traceroute(6)s?

The following shows up in the syslog with ufw enabled:

50:15:15:aa:ae:8d:7d:e4:7a:97:08:00 SRC=79.236.233.97 DST=78.46.101.252 LEN=52 TOS=0x00 PREC=0x00 TTL=1 ID=33400 PROTO=UDP SPT=63757 DPT=33466 LEN=32
Nov  4 16:20:36 web kernel: [8078158.260409] [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:15:15:aa:ae:8d:7d:e4:7a:97:08:00 SRC=79.236.233.97 DST=78.46.101.252 LEN=52 TOS=0x00 PREC=0x00 TTL=1 ID=33401 PROTO=UDP SPT=63757 DPT=33467 LEN=32
Nov  4 16:20:41 web kernel: [8078163.262626] [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:15:15:aa:ae:8d:7d:e4:7a:97:08:00 SRC=79.236.233.97 DST=78.46.101.252 LEN=52 TOS=0x00 PREC=0x00 TTL=2 ID=33402 PROTO=UDP SPT=63757 DPT=33468 LEN=32
Nov  4 16:20:46 web kernel: [8078168.262927] [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:15:15:aa:ae:8d:7d:e4:7a:97:08:00 SRC=79.236.233.97 DST=78.46.101.252 LEN=52 TOS=0x00 PREC=0x00 TTL=2 ID=33403 PROTO=UDP SPT=63757 DPT=33469 LEN=32
Nov  4 16:20:51 web kernel: [8078173.260521] [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:15:15:aa:ae:8d:7d:e4:7a:97:08:00 SRC=79.236.233.97 DST=78.46.101.252 LEN=52 TOS=0x00 PREC=0x00 TTL=2 ID=33404 PROTO=UDP SPT=63757 DPT=33470 LEN=32

And the trace route just ends in starts after the Proxmox host machine.

Thanks

Tobias Timpe

Improve this question

1 Answer 1

Reset to default
3

Traceroute uses ICMP packets, so you would need to allow ICMP packets.

ufw does not allow specifying icmp rules via the command line interface command so you will need to edit the rules file

However ufw does allow certain icmp traffic by default including icmp echo reply, and this is already configured by default in /etc/ufw/before.rules:

-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

If your host is not responding to ping, look in this file to make sure the above line is present and if that doesn't work, look at the pinging host and any firewalls between them.

To allow traceroute you need to edit /etc/ufw/before.rules

-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

To see what is set before you edit the file, try the below

sudo grep 'icmp' /etc/ufw/before.rules

Note:

Traceroute sends a sequence of three Internet Control Message Protocol (ICMP) echo request packets addressed to a destination host. The time-to-live (TTL) value, also known as hop limit, is used in determining the intermediate routers being traversed towards the destination.

Improve this answer
3
  • 1
    Traceroute relies on ICMP replies but sends UDP by default (can also send TCP and ICMP)
    – symcbean
    Nov 4, 2013 at 16:09
  • @symcbean So what rule do I need to add to allow a standard UDP tr
    – Tobias Timpe
    Nov 4, 2013 at 20:26
  • No idea - don't use ubuntu, just iptables
    – symcbean
    Nov 4, 2013 at 21:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .