Run traceroute

If you have a Magic WAN client connected through GRE, IPsec, CNI or WARP and want to perform a traceroute to an endpoint behind a Cloudflare Tunnel, the following settings must be applied for the command to return useful information.

Inherited TTL value

On the machine where the traceroute client is executed, make sure the tunnel device does not inherit the TTL value of the inner packet. This is the default behavior on Linux and can result in unhelpful traceroute results:

sudo traceroute -s 10.1.0.100 -I 10.3.0.100

traceroute to 10.3.0.100 (10.3.0.100), 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  10.3.0.100 (10.3.0.100)  420.505 ms  420.779 ms  420.776 ms

Setting the TTL explicitly returns much better results:

sudo ip link set cf_gre type gre ttl 64
sudo traceroute -s 10.1.0.100 -I 10.3.0.100

traceroute to 10.3.0.100 (10.3.0.100), 30 hops max, 60 byte packets
 1  10.0.0.11 (10.0.0.11)  58.947 ms  58.933 ms  58.930 ms
 2  173.245.60.175 (173.245.60.175)  61.138 ms  61.316 ms  61.313 ms
 3  172.68.145.21 (172.68.145.21)  367.448 ms  367.532 ms  367.530 ms
 4  mplat-e2e-vm3.c.magic-transit.internal (10.152.0.20)  370.362 ms  370.440 ms  370.522 ms
 5  10.3.0.100 (10.3.0.100)  370.519 ms  370.541 ms  518.152 ms

WARP client

Some Linux distributions default to a very strict setting for reverse path filtering ↗. This strict setting attempts to drop fake traffic as a security measure. Performing a traceroute with this setting on can unintentionally drop traceroute packets. If you use WARP on Linux, set a less strict policy before attempting to perform a traceroute:

sudo sysctl -w net.ipv4.conf.CloudflareWARP.rp_filter=2

net.ipv4.conf.CloudflareWARP.rp_filter = 2

sudo traceroute -s 172.16.0.2 -I 10.3.0.100

traceroute to 10.3.0.100 (10.3.0.100), 30 hops max, 60 byte packets
 1  169.254.21.171 (169.254.21.171)  48.887 ms  48.894 ms  48.620 ms
 2  173.245.60.175 (173.245.60.175)  49.403 ms  49.519 ms  49.603 ms
 3  172.68.65.7 (172.68.65.7)  357.499 ms  357.519 ms  357.520 ms
 4  mplat-e2e-vm3.c.magic-transit.internal (10.152.0.20)  360.024 ms  360.086 ms  360.078 ms
 5  10.3.0.100 (10.3.0.100)  360.283 ms  360.297 ms  360.489 ms