Skip to content

Commit 9b3a715

Browse files
ranbelranbel
authored
[ZT] ICMP command updates (#23409)
* refine ICMP commands * add step # * Update src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/common-errors.mdx * move instructions to Proxy page * Update src/content/docs/cloudflare-one/policies/gateway/proxy.mdx
1 parent 36dbb19 commit 9b3a715

File tree

3 files changed

+67
-38
lines changed

3 files changed

+67
-38
lines changed

‎src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/common-errors.mdx‎

Lines changed: 1 addition & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -138,42 +138,7 @@ net.core.rmem_max = 2500000
138138
139139
## `ping` and `traceroute` commands do not work.
140140
141-
To ping an IP address behind Cloudflare Tunnel, your system must allow ICMP traffic through `cloudflared`:
142-
143-
<Tabs> <TabItem label="Linux" icon="linux">
144-
145-
1. Ensure that `ping_group_range` includes the Group ID (GID) of the user running `cloudflared`.
146-
147-
1. To get the Group ID of the user, run `id -g`.
148-
2. To verify the Group IDs that are allowed to use ICMP:
149-
150-
```sh
151-
sudo sysctl net.ipv4.ping_group_range
152-
```
153-
154-
```sh output
155-
net.ipv4.ping_group_range= 0 10000
156-
```
157-
158-
3. Either add the user to a group within that range, or update the range to encompass a group the user is already in. To update `ping_group_range`:
159-
160-
```sh
161-
echo 0 10001 | sudo tee /proc/sys/net/ipv4/ping_group_range
162-
```
163-
164-
2. If you are running multiple network interfaces (for example, `eth0` and `eth1`), configure `cloudflared` to use the external Internet-facing interface:
165-
166-
```sh
167-
cloudflared tunnel run --icmpv4-src <IP of primary interface>
168-
```
169-
170-
</TabItem> <TabItem label="Docker" icon="seti:docker">
171-
172-
In your environment, modify the `ping_group_range` parameter to include the Group ID (GID) of the user running `cloudflared`.
173-
174-
By default the [`cloudflared` Docker container](https://github.com/cloudflare/cloudflared/blob/master/Dockerfile#L29C6-L29C13) executes as a user called `nonroot` inside of the container. `nonroot` is a specific user that exists in the [base image](https://github.com/GoogleContainerTools/distroless/blob/859eeea1f9b3b7d59bdcd7e24a977f721e4a406c/base/base.bzl#L8) we use, and its Group ID is hardcoded to 65532.
175-
176-
</TabItem> </Tabs>
141+
To ping an IP address behind Cloudflare Tunnel, your system must allow ICMP traffic through `cloudflared`. For configuration instructions, refer to the [ICMP proxy documentation](/cloudflare-one/policies/gateway/proxy/#icmp).
177142
178143
## Cloudflare Tunnel is buffering my streaming response instead of streaming it live.
179144

‎src/content/docs/cloudflare-one/policies/gateway/proxy.mdx‎

Lines changed: 65 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 12
66
---
77

8-
import { Badge } from "~/components";
8+
import { Badge, Tabs, TabItem } from "~/components";
99

1010
You can forward [HTTP](/cloudflare-one/policies/gateway/initial-setup/http/) and [network](/cloudflare-one/policies/gateway/initial-setup/network/) traffic to Gateway for logging and filtering. Gateway can proxy both outbound traffic and traffic directed to resources connected via a Cloudflare Tunnel, GRE tunnel, or IPsec tunnel. When a user connects to the Gateway proxy, Gateway will accept the connection and establish a new, separate connection to the origin server.
1111

@@ -66,6 +66,70 @@ The ICMP proxy forwards traffic for diagnostic tools such as `ping` and `tracero
6666
Gateway cannot log or filter ICMP traffic.
6767
:::
6868

69+
#### Allow ICMP traffic through `cloudflared`
70+
71+
To use the ICMP proxy with Cloudflare Tunnel, you may need to configure the `cloudflared` host to allow ICMP traffic through `cloudflared`.
72+
73+
<Tabs> <TabItem label="Linux" icon="linux">
74+
75+
1. Ensure that `ping_group_range` includes the Group ID (GID) of the user running `cloudflared`:
76+
77+
a. Find the user that owns the `cloudflared` process:
78+
79+
```sh
80+
ps -aux | grep cloudflared
81+
```
82+
83+
```sh output
84+
johndoe 407 0.8 1.7 1259904 35296 ? Ssl 21:02 0:00 /usr/bin/cloudflared --no-autoupdate tunnel run --token eyJhI...
85+
```
86+
87+
b. Get the Group ID of the `cloudflared` user:
88+
89+
```sh
90+
id -g johndoe
91+
```
92+
93+
```sh output
94+
10001
95+
```
96+
97+
c. Determine the Group IDs that are allowed to use ICMP:
98+
99+
```sh
100+
sudo sysctl net.ipv4.ping_group_range
101+
```
102+
103+
```sh output
104+
net.ipv4.ping_group_range= 0 10000
105+
```
106+
107+
d. Either add the user to a group within that range, or update the range to encompass a group the user is already in. To update `ping_group_range`:
108+
109+
```sh
110+
echo 0 10001 | sudo tee /proc/sys/net/ipv4/ping_group_range
111+
```
112+
113+
e. To make the change persist on reboot, update your `systcl` parameters:
114+
115+
```sh
116+
echo "net.ipv4.ping_group_range = 0 10001" | sudo tee -a /etc/sysctl.d/99-cloudflared.conf
117+
```
118+
119+
2. If you are running multiple network interfaces (for example, `eth0` and `eth1`), configure `cloudflared` to use the external Internet-facing interface:
120+
121+
```sh
122+
cloudflared tunnel run --icmpv4-src <IP of primary interface>
123+
```
124+
125+
</TabItem> <TabItem label="Docker" icon="seti:docker">
126+
127+
In your environment, modify the `ping_group_range` parameter to include the Group ID (GID) of the user running `cloudflared`.
128+
129+
By default the [`cloudflared` Docker container](https://github.com/cloudflare/cloudflared/blob/master/Dockerfile#L29C6-L29C13) executes as a user called `nonroot` inside of the container. `nonroot` is a specific user that exists in the [base image](https://github.com/GoogleContainerTools/distroless/blob/859eeea1f9b3b7d59bdcd7e24a977f721e4a406c/base/base.bzl#L8) we use, and its Group ID is hardcoded to 65532.
130+
131+
</TabItem> </Tabs>
132+
69133
## Turn on the Gateway proxy
70134

71135
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **Network**.

‎src/content/partials/cloudflare-one/tunnel/enable-gateway-proxy.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import { Tabs, TabItem } from "~/components";
1010
2. In **Firewall**, turn on **Proxy**.
1111
3. Select **TCP**.
1212
4. (Recommended) To proxy traffic to internal DNS resolvers, select **UDP**.
13-
5. (Recommended) To proxy traffic for diagnostic tools such as `ping` and `traceroute`, select **ICMP**. You may also need to [update your system](/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/common-errors/#ping-and-traceroute-commands-do-not-work) to allow ICMP traffic through `cloudflared`.
13+
5. (Recommended) To proxy traffic for diagnostic tools such as `ping` and `traceroute`, select **ICMP**. You may also need to [update your system](/cloudflare-one/policies/gateway/proxy/#icmp) to allow ICMP traffic through `cloudflared`.
1414

1515
</TabItem>
1616
<TabItem label="Terraform (v5)">

0 commit comments

Comments
 (0)