Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a LAN of Linux computers that get access to the Internet over NAT. The gateway runs a restrictive firewall. I have ICMP echo requests and replies allowed to pass through the firewall on the gateway, so I can ping any external host from a LAN computer, but mtr and traceroute to an external host hang at the gateway hop.

What additional firewall rules should I have so these tools would work properly?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Linux traceroute uses UDP by default, on a random high port, while Windows tracert uses ICMP. For your Linux machines, you'll either need to configure the firewall to allow UDP on high ports, or use the -I commandline switch to specify the use of ICMP ECHO instead of UDP datagrams.

Edited to add: By default, it picks a random port in the unassigned ports range, commonly referred to as "high ports". Typically this means a port in the 49152–65535 range (see this port list). The man page refers to this as an "unlikely value" for a service to be running on inadvertently, since we don't actually want the host to process the UDP datagrams as information. If you want, you can specify the port with -p, but be aware that it will increment the destination port by 1 with each probe when using UDP. If you want to use a constant port, specify the -U switch (default port is 53 for this). Alternatively, if you don't want to use UDP or ICMP, you can use the -T switch to specify TCP SYN mode, which will use a constant port that you can set with -p. Then you would open that port on your firewall.

Only UDP is allowed for unprivileged users.

share|improve this answer
I assume "high ports" is supposed to mean a certain port range, is this documented somewhere? –  Anonymous Dec 2 '09 at 9:17
See my edit. You can look up the traceroute man page if you want to know more. –  phoebus Dec 2 '09 at 9:33
Thanks, traceroute -I did the trick, I also had to allow ICMP "time exceeded" (type 11) in my firewall (I had only ICMP echo requests and replies allowed as I stated in my question). I've also read the man page for traceroute one more time and I couldn't find anything about a -T switch there. May I know what OS do you use and what version of traceroute do you use, just for general knowledge? –  Anonymous Dec 2 '09 at 9:41
I'm using traceroute version 2.0.9, Nov 19 2007, on Ubuntu 8.04 LTS. –  phoebus Dec 2 '09 at 9:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.