{"record":{"id":"5bf00030453fdfbc","repo":"cloudflare/cloudflared","slug":"cannot-create-icmpv4-proxy-v-nor-icmpv6-proxy","errorCode":null,"errorMessage":"cannot create ICMPv4 proxy: %v nor ICMPv6 proxy: %v","messagePattern":"cannot create ICMPv4 proxy: (.+?) nor ICMPv6 proxy: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/origin_icmp_proxy.go","lineNumber":71,"sourceCode":"\tReplySpan(ctx context.Context, logger *zerolog.Logger) (context.Context, trace.Span)\n\tExportSpan()\n}\n\ntype icmpRouter struct {\n\tipv4Proxy *icmpProxy\n\tipv4Src   netip.Addr\n\tipv6Proxy *icmpProxy\n\tipv6Src   netip.Addr\n}\n\n// NewICMPRouter doesn't return an error if either ipv4 proxy or ipv6 proxy can be created. The machine might only\n// support one of them.\n// funnelIdleTimeout controls how long to wait to close a funnel without send/return\nfunc NewICMPRouter(ipv4Addr, ipv6Addr netip.Addr, logger *zerolog.Logger, funnelIdleTimeout time.Duration) (ICMPRouterServer, error) {\n\tipv4Proxy, ipv4Err := newICMPProxy(ipv4Addr, logger, funnelIdleTimeout)\n\tipv6Proxy, ipv6Err := newICMPProxy(ipv6Addr, logger, funnelIdleTimeout)\n\tif ipv4Err != nil && ipv6Err != nil {\n\t\terr := fmt.Errorf(\"cannot create ICMPv4 proxy: %v nor ICMPv6 proxy: %v\", ipv4Err, ipv6Err)\n\t\tlogger.Debug().Err(err).Msg(\"ICMP proxy feature is disabled\")\n\t\treturn nil, err\n\t}\n\tif ipv4Err != nil {\n\t\tlogger.Debug().Err(ipv4Err).Msg(\"failed to create ICMPv4 proxy, only ICMPv6 proxy is created\")\n\t\tipv4Proxy = nil\n\t}\n\tif ipv6Err != nil {\n\t\tlogger.Debug().Err(ipv6Err).Msg(\"failed to create ICMPv6 proxy, only ICMPv4 proxy is created\")\n\t\tipv6Proxy = nil\n\t}\n\treturn &icmpRouter{\n\t\tipv4Proxy: ipv4Proxy,\n\t\tipv4Src:   ipv4Addr,\n\t\tipv6Proxy: ipv6Proxy,\n\t\tipv6Src:   ipv6Addr,\n\t}, nil\n}","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/origin_icmp_proxy.go#L53-L89","documentation":"NewICMPRouter tries to create both an ICMPv4 and an ICMPv6 proxy. Only if BOTH fail does it return this combined error (and disable the ICMP proxy feature); if one succeeds, the failed family is merely logged and skipped. Both usually fail for the same reason: inability to bind a raw ICMP socket.","triggerScenarios":"Calling newICMPRouter (or NewICMPRouter directly in tests) on a host where neither an IPv4 nor an IPv6 ICMP proxy can be created — e.g. running without root/CAP_NET_RAW, ICMP disabled via sysctl, or no IPv4/IPv6 addresses configured.","commonSituations":"Running cloudflared as an unprivileged user or in a container without NET_RAW capability; icmpv4/icmpv6 host addresses not configured on any interface.","solutions":["Run cloudflared with sufficient privileges (root or CAP_NET_RAW capability)","Set the --icmpv4-src / --icmpv6-src host addresses to IPs actually assigned to a local interface","Enable ICMP in the kernel/sysctl if disabled (e.g. in restricted containers)","If only one family fails, treat the debug log as expected degraded behavior — the router still serves the other family"],"exampleFix":"// before (unprivileged)\n./cloudflared tunnel run NAME\n// after\nsudo setcap cap_net_raw+ep ./cloudflared\n./cloudflared tunnel run NAME","handlingStrategy":"try-catch","validationCode":"if !hasCapNetRaw() && runtime.GOOS == \"linux\" {\n\t// ICMP proxy will likely fail on both families; skip or elevate first\n}","typeGuard":null,"tryCatchPattern":"router, err := ingress.NewICMPRouter(ipv4, ipv6, logger, timeout)\nif err != nil {\n\tif strings.Contains(err.Error(), \"cannot create ICMPv4 proxy\") {\n\t\tlogger.Warn().Msg(\"ICMP proxy disabled: need NET_RAW privileges\")\n\t\treturn nil // continue without ICMP\n\t}\n\treturn err\n}","preventionTips":["Run with CAP_NET_RAW or as root when ICMP proxying is needed","Configure icmpv4-src/icmpv6-src to local interface addresses","Check container capability flags before deployment"],"tags":["icmp","proxy","permissions"],"backgroundTag":"permission-denied","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}