{"record":{"id":"f82f1d0ed204a59a","repo":"cloudflare/cloudflared","slug":"failed-to-determine-ipv4-source-address-for-icmp-p","errorCode":null,"errorMessage":"failed to determine IPv4 source address for ICMP proxy","messagePattern":"failed to determine IPv4 source address for ICMP proxy","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/tunnel/configuration.go","lineNumber":372,"sourceCode":"}\n\nfunc newICMPRouter(c *cli.Context, logger *zerolog.Logger) (ingress.ICMPRouterServer, error) {\n\tipv4Src, ipv6Src, err := determineICMPSources(c, logger)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\ticmpRouter, err := ingress.NewICMPRouter(ipv4Src, ipv6Src, logger, icmpFunnelTimeout)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn icmpRouter, nil\n}\n\nfunc determineICMPSources(c *cli.Context, logger *zerolog.Logger) (netip.Addr, netip.Addr, error) {\n\tipv4Src, err := determineICMPv4Src(c.String(flags.ICMPV4Src), logger)\n\tif err != nil {\n\t\treturn netip.Addr{}, netip.Addr{}, errors.Wrap(err, \"failed to determine IPv4 source address for ICMP proxy\")\n\t}\n\n\tlogger.Info().Msgf(\"ICMP proxy will use %s as source for IPv4\", ipv4Src)\n\n\tipv6Src, zone, err := determineICMPv6Src(c.String(flags.ICMPV6Src), logger, ipv4Src)\n\tif err != nil {\n\t\treturn netip.Addr{}, netip.Addr{}, errors.Wrap(err, \"failed to determine IPv6 source address for ICMP proxy\")\n\t}\n\n\tif zone != \"\" {\n\t\tlogger.Info().Msgf(\"ICMP proxy will use %s in zone %s as source for IPv6\", ipv6Src, zone)\n\t} else {\n\t\tlogger.Info().Msgf(\"ICMP proxy will use %s as source for IPv6\", ipv6Src)\n\t}\n\n\treturn ipv4Src, ipv6Src, nil\n}\n","sourceCodeStart":354,"sourceCodeEnd":390,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/tunnel/configuration.go#L354-L390","documentation":"determineICMPSources resolves the IPv4 source address the ICMP proxy will use when forwarding ping/trace packets. determineICMPv4Src fails when no explicit --icmpv4-src is given and no usable local IPv4 address can be found (or the explicitly provided one is invalid). The error is wrapped as 'failed to determine IPv4 source address for ICMP proxy'.","triggerScenarios":"Enabling ICMP proxying (--icmp-router / proxy functionality) on a host with no IPv4 address assigned, or passing an invalid --icmpv4-src value; running inside containers/network namespaces lacking IPv4.","commonSituations":"IPv6-only VMs or containers; Docker/Kubernetes pods without an IPv4 interface; typo'd --icmpv4-src CIDR/IP; sandboxed environments (e.g. some CI) without a routable v4 address.","solutions":["Explicitly set the source: --icmpv4-src <valid-local-ipv4> matching an interface on the host.","Ensure the host/network namespace has an IPv4 address assigned (ip addr show).","Remove the invalid --icmpv4-src value if it was a typo.","Disable ICMP proxying if the environment cannot support it."],"exampleFix":"// before (IPv6-only container)\ncloudflared tunnel run --icmpv4-src 10.0.0.5 my-tunnel\n// after\nip addr add 192.168.1.10/24 dev eth0\ncloudflared tunnel run --icmpv4-src 192.168.1.10 my-tunnel","handlingStrategy":"validation","validationCode":"// verify a local IPv4 source exists before enabling ICMP\nfunc hasIPv4Source(src string) error {\n\taddr, err := netip.ParseAddr(src)\n\tif err != nil { return err }\n\tif !addr.Is4() { return fmt.Errorf(\"%s is not IPv4\", src) }\n\tconn, err := net.Dial(\"udp4\", \"8.8.8.8:53\")\n\tif err != nil { return err }\n\t_ = conn.Close()\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"ipv4Src, err := determineICMPv4Src(c.String(flags.ICMPV4Src), logger)\nif err != nil {\n\treturn netip.Addr{}, netip.Addr{}, errors.Wrap(err, \"failed to determine IPv4 source address for ICMP proxy\")\n}","preventionTips":["Set --icmpv4-src explicitly on hosts with multiple interfaces","Verify the host has an IPv4 address before enabling ICMP proxying","Skip ICMP proxying in IPv6-only or sandboxed environments","Test `ping` from inside the container to confirm raw socket/addr support"],"tags":["network","icmp","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}