Skip to content

[ZT] ICMP command updates #23409

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jul 3, 2025
Merged

[ZT] ICMP command updates #23409

Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a0fe7a7
refine ICMP commands
ranbel Jul 2, 2025
f2a3e12
add step #
ranbel Jul 2, 2025
991cbed
Update src/content/docs/cloudflare-one/connections/connect-networks/t…
ranbel Jul 3, 2025
c05730a
move instructions to Proxy page
ranbel Jul 3, 2025
30e1669
Update src/content/docs/cloudflare-one/policies/gateway/proxy.mdx
ranbel Jul 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 29 additions & 4 deletions ...udflare-one/connections/connect-networks/troubleshoot-tunnels/common-errors.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,10 +142,29 @@ To ping an IP address behind Cloudflare Tunnel, your system must allow ICMP traf

<Tabs> <TabItem label="Linux" icon="linux">

1. Ensure that `ping_group_range` includes the Group ID (GID) of the user running `cloudflared`.
1. Ensure that `ping_group_range` includes the Group ID (GID) of the user running `cloudflared`:

1. To get the Group ID of the user, run `id -g`.
2. To verify the Group IDs that are allowed to use ICMP:
a. Find the user that owns the `cloudflared` process:

```sh
ps -aux | grep cloudflared
```

```sh output
johndoe 407 0.8 1.7 1259904 35296 ? Ssl 21:02 0:00 /usr/bin/cloudflared --no-autoupdate tunnel run --token eyJhI...
```

b. Get the Group ID of the `cloudflared` user:

```sh
id -g johndoe
```

```sh output
10001
```

c. Determine the Group IDs that are allowed to use ICMP:

```sh
sudo sysctl net.ipv4.ping_group_range
Expand All @@ -155,10 +174,16 @@ To ping an IP address behind Cloudflare Tunnel, your system must allow ICMP traf
net.ipv4.ping_group_range= 0 10000
```

3. Either add the user to a group within that range, or update the range to encompass a group the user is already in. To update `ping_group_range`:
d. Either add the user to a group within that range, or update the range to encompass a group the user is already in. To update `ping_group_range`:

```sh
echo 0 10001 | sudo tee /proc/sys/net/ipv4/ping_group_range
```

e. To make the change persist on reboot, update your `systcl` parameters:

```sh
echo "net.ipv4.ping_group_range = 0 10001" | sudo tee /etc/sysctl.d/99-cloudflared.conf
```

2. If you are running multiple network interfaces (for example, `eth0` and `eth1`), configure `cloudflared` to use the external Internet-facing interface:
Expand Down