Private Resource Port Restriction Issue with ICMP/ping #416

New Issue

MrUnknownDE · 2026-04-05T17:09:36+02:00

MrUnknownDE commented

2026-04-05 17:09:36 +02:00

Originally created by @oschwartz10612 on 12/31/2025

Discussed in https://github.com/orgs/fosrl/discussions/2192

^{Originally posted by shucking December 31, 2025}
When all ports are allowed on TCP and UDP and ICMP is switched on, ping works. However, when TCP and UDP are blocked and ICMP is still switched on, ping fails. Below are Newt logs and a screenshot of the Pangolin UI settings for a private resource. Shouldn't ping work, given ICMP is still enabled?

Former Situation:

Added target subnet from [wg cidr] to [private resource cidr] rewrite to  with port ranges: []
...
ICMP Handler: Echo Request [wg ip] to [private resource ip] (ident=1592, seq=1)
ICMP Handler: Matched subnet rule for [wg ip] -> [private resource ip]
ICMP Handler: Ping successful to [private resource ip] using raw ICMP, injecting reply (ident=1592, seq=1)

Latter Situation:

Removed target subnet [wg cidr] with destination [private resource cidr]
Removed target subnet [wg cidr] with destination [private resource cidr]
Added target subnet from [wg cidr] to [private resource cidr] rewrite to  with port ranges: [{0 0 tcp} {0 0 udp}]
Added target subnet from [wg cidr] to [private resource cidr] rewrite to  with port ranges: [{0 0 tcp} {0 0 udp}]

*Originally created by @oschwartz10612 on 12/31/2025* ### Discussed in https://github.com/orgs/fosrl/discussions/2192 <div type='discussions-op-text'> <sup>Originally posted by **shucking** December 31, 2025</sup> When all ports are allowed on TCP and UDP and ICMP is switched on, ping works. However, when TCP and UDP are blocked and ICMP is still switched on, ping fails. Below are Newt logs and a screenshot of the Pangolin UI settings for a private resource. Shouldn't ping work, given ICMP is still enabled? Former Situation: ```shell Added target subnet from [wg cidr] to [private resource cidr] rewrite to with port ranges: [] ... ICMP Handler: Echo Request [wg ip] to [private resource ip] (ident=1592, seq=1) ICMP Handler: Matched subnet rule for [wg ip] -> [private resource ip] ICMP Handler: Ping successful to [private resource ip] using raw ICMP, injecting reply (ident=1592, seq=1) ``` Latter Situation: ```shell Removed target subnet [wg cidr] with destination [private resource cidr] Removed target subnet [wg cidr] with destination [private resource cidr] Added target subnet from [wg cidr] to [private resource cidr] rewrite to with port ranges: [{0 0 tcp} {0 0 udp}] Added target subnet from [wg cidr] to [private resource cidr] rewrite to with port ranges: [{0 0 tcp} {0 0 udp}] ``` <img width="1113" height="362" alt="privrsrc" src="https://github.com/user-attachments/assets/5168cb5c-180f-4494-8ad8-287969546efe" /></div>

MrUnknownDE added the bug bug bug bug bug bug bug bug bug bug bug bug bug bug labels 2026-04-05 17:09:37 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label bug bug bug bug bug bug bug bug bug bug bug bug bug bug

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#416