When I try to traceroute to a remote ip, I get send: Operation not permitted When I stop iptables, traceroute works fine. So, I assume I need some ip rule for send. What would that rule be?

I did find a solution here http://forums.fedoraforum.org/showthread.php?t=112516, and I add it to my iptables, restart it, but then after a while CSF seems to block send again. Something overwrites that rule.

1 Answer 1


Found the solution:

Do you have CSF installed? If yes, open the config page for CSF and search the page for traceroute. There you'll see this message:

# Allow outgoing UDP ports

# To allow outgoing traceroute add 33434:33523 to this list

  • Thank you very much! adding CSF ports to outgoing traceroute solve this issue.
    – user294390
    Commented Jun 16, 2015 at 2:16
  • 1
    Please note that in CSF you must add the port range for IPv6 as well if you want to perform a traceroute6 (UDP6_OUT) Commented Oct 11, 2017 at 9:13
  • 2
    CSF == ConfigServer Security & Firewall configserver.com/cp/csf.html Commented Jan 19, 2019 at 17:10
  • Where is the config page for CSF? Commented Sep 27, 2020 at 8:00
  • If you are using cPanel / WHM, then search for ConfigServer Security & Firewall to find the config page for CSF.
    – David
    Commented Apr 5, 2022 at 18:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .