Does firewall block traceroute

[BusinessUser]

I have a fortwifi/fortigate 60e.

I do a traceroute to the internet from the pc and it stops at the firewall of 192.168.1.54.

But it actual fact I can ping to the ISP.

Firewall policies are normal. (LAN->WAN allowed)

So does the firewall block traceroute traffic in any way?

[AlexC-FTNT]

The answer to that is related to how traceroute works.
By sending packets of data (ICMP) with increasing TTL values, traceroutes allow you to trace the path of data packets through a network. When a router receives such packet it has two options:
- reply with "TTL expired in transit" (in this case you will see the IP of the device in traceroute)
- ignore the packet and not send a reply (safer from the router/device perspective)

So the things to check on FortiGate is whether the "TTL expired in transit" packet is passed from Wan to Lan, and if there is DNAT applied to this traffic (should not be)

[spoojary]

f your traceroute stops at the FortiGate firewall but you can ping the ISP, it's likely due to FortiGate handling ICMP or UDP packets differently. Here's a summary:

1. ICMP Blocking: FortiGate might block certain ICMP messages crucial for traceroute, even if pings (ICMP echo) are allowed.
2. Policy-Based Configuration: Ensure policies permit both ICMP "Time Exceeded" and "Destination Unreachable" messages.
3. Rate Limiting: FortiGate may limit ICMP message rates, affecting traceroute.
4. Session TTL: Check session TTL settings in FortiGate, as they can impact traceroute results.

For resolution, ensure ICMP-related policies are correctly set, adjust rate limiting if necessary, and review session TTL settings. Always adjust firewall settings with caution.

[pminarik]

Might be worth highlighting that Windows and Linux use different methods for traceroute.

Windows is ICMP only, so if the firewall policy allows service=ICMP (or ALL), it should match.

Linux uses by default UDP, incrementing the dst port per each probe, starting by default from 33434. This default behaviour matches the preconfigured service "TRACEROUTE" in FortiOS (UDP/33434-33535, so it's good for up to 101 hops). Similarly, this should be matched by a policy with service=TRACEROUTE (or ALL).

Be aware that Linux traceroute can be switched to ICMP, or to TCP (defaults to port 80), and even the starting port can be customized. So depending on how creative the person running the traceroute is, you may even need to create a custom service for this in FortiGate.

And with all that said, a policy with service=ALL should let through any traceroute attempt, of course. :)

[BusinessUser]

And with all that said, a policy with service=ALL should let through any traceroute attempt, of course. :)

Does it need to be bidirectional?

[pminarik]

You do not need a special policy in the direction of the ICMP reply.

FortiGate automatically permits ICMP responses (TTL exceeded, port unreachable, etc.) as a reply-direction traffic through the relevant firewall policy, matching to the existing session.