Get Traceroue To Work with Iptables

Get Traceroue To Work with Iptables

So I was trying to use trace route to diagnose why my some DNS problems but it was timing out.

As you may know I am using CloudFlare for DNS hosting and other things. Any way may traceroute worked OK with my CloudFlare enabled sites but when I tried my newly setup Ubuntu server (which is not using the CloudFlare network, see my article Sky Broadband Blocks CloudFlare CDN) it failed.

I figured the problem must be a firewall issue as the server was accessible via ping. A quick look around and look into my iptables rules and a search on google found the problem. My rules for ping where:-

-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

which was fine to allow ping but traceroute uses UDP with a port range from 33434 to 33534. So the server must not drop icmp type 8 or UDP 33434:33534. For traceroute to work we also don't need accept the packet we can reject them and it still will work, so our new rules will be:

-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p udp --dport 33434:33523 -j REJECT

now our trace route will work properly. Hope it helps

These ports should not be in use by any other application


25/01/2015 22:09:00 Shaun Freeman Filed Under: Linux iptables, Linux, Server, Ubuntu

Twitter Feed
Shaun Freeman @Zendmaster

Shaun Freeman @Zendmaster

I liked a @YouTube video https://t.co/8nGfvmdsI2 From Carnivore Diet to Near-Death: Lessons Learned From Today's Most Popular Fad Diet

Shaun Freeman @Zendmaster

I liked a @YouTube video https://t.co/EFLh2y3I24 Carnivore Diet – Myths about Meat – Phil Escott – WHIS 2018

Shaun Freeman @Zendmaster

I liked a @YouTube video https://t.co/dTcBFM4q5A WHY I STOPPED BEING VEGAN | MY STORY

Shaun Freeman @Zendmaster

I liked a @YouTube video https://t.co/RVuVCieSsD Dr. Paul Mason - 'Low Carb from a Doctor's perspective'

Shaun Freeman @Zendmaster

I added a video to a @YouTube playlist https://t.co/MFRRuBG23F It's Already Too Late - Elon Musk