Linux traceroute packets blocked, but not window packets

junior_kakou — Sat, 08 Feb 2025 21:51:10 GMT

Hello everyone;
i have set up a site to site vpn between our site A and site B with two mikrotik routers. the vpn works well. both sites can see each other. behind site A is a 3600 firewall and the pc's of both sites can see each other.
when i ping back and forth from a windows pc as well as a linux pc, the pings go through. a traceroute back and forth from a windows pc, we can reach the pc behind the firewall. But a traceroute from a linux PC can't reach the PC behind the firewall at site A. The packets don't get through the router.
To sum up:
a tracert from Site B on Windows reaches the PC behind Site A's firewall;
a traceroute from Site B on linux can't reach the pc behind Site A's firewall.

what could be the problem???
Thanks

Re: Linux traceroute packets blocked, but not window packets

Timothy_Hall — Sun, 09 Feb 2025 13:32:51 GMT

Windows tracert sends ICMP requests, while Unix/Linux traceroute sends UDP packets bound for UDP high ports. Use the tracert command from Gaia/Linux and it will work, you must be blocking UDP high ports somewhere in the path but not ICMP echo requests.

Edit: Windows tracert expects to get ICMP echo replies as responses, while Unix traceroute expects to receive Destination/Port unreachable responses. So those latter types of responses could be getting blocked.

topic Linux traceroute packets blocked, but not window packets in Firewall and Security Management

Linux traceroute packets blocked, but not window packets

Re: Linux traceroute packets blocked, but not window packets