cloudflare/cloudflared · error

cannot send ICMPv4 using ICMPv6 proxy

Error message

cannot send ICMPv4 using ICMPv6 proxy

What it means

The Windows ICMP proxy counterpart to error 268: when the proxy was created with an ICMPv6 source socket (srcSocketAddr != nil) it cannot handle ICMPv4 echo requests, and icmpEchoRoundtrip returns this error. The socket family and destination family must match.

Source

Thrown at ingress/icmp_windows.go:344

		},
	}
	return responder.ReturnPacket(&pk)
}

func (ip *icmpProxy) icmpEchoRoundtrip(dst netip.Addr, echo *icmp.Echo) (echoResp, error) {
	if dst.Is6() {
		if ip.srcSocketAddr == nil {
			return nil, fmt.Errorf("cannot send ICMPv6 using ICMPv4 proxy")
		}
		resp, err := ip.icmp6SendEcho(dst, echo)
		if err != nil {

			return nil, errors.Wrap(err, "failed to send/receive ICMPv6 echo")
		}
		return resp, nil
	}
	if ip.srcSocketAddr != nil {
		return nil, fmt.Errorf("cannot send ICMPv4 using ICMPv6 proxy")
	}
	resp, err := ip.icmpSendEcho(dst, echo)
	if err != nil {
		return nil, errors.Wrap(err, "failed to send/receive ICMPv4 echo")
	}
	return resp, nil
}

/*
Wrapper to call https://docs.microsoft.com/en-us/windows/win32/api/icmpapi/nf-icmpapi-icmpsendecho
Parameters:
- IcmpHandle: Handle created by IcmpCreateFile
- DestinationAddress: IPv4 in the form of https://docs.microsoft.com/en-us/windows/win32/api/inaddr/ns-inaddr-in_addr#syntax
- RequestData: A pointer to echo data
- RequestSize: Number of bytes in buffer pointed by echo data
- RequestOptions: IP header options
- ReplyBuffer: A pointer to the buffer for echoReply, options and data
- ReplySize: Number of bytes allocated for ReplyBuffer

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Route IPv4 destinations to an ICMPv4-initialized proxy instance (restart cloudflared so both families are set up correctly).
2. Use an IPv6 destination (AAAA record) if the proxy is intentionally ICMPv6-only.
3. Check cloudflared startup logs to confirm which ICMP socket family was bound and adjust the ingress/routing rules accordingly.
4. If both families are needed, run in an environment where cloudflared establishes both v4 and v6 ICMP sockets (network with both stacks enabled).

if !pkt.Dst.Is6() && proxy.SrcSocketAddr != nil {
    // IPv4 destination on an IPv6-bound proxy: reroute to a v4 proxy instance
}

func proxySupportsIPv4(p *icmpProxy) bool { return p.srcSocketAddr == nil }
// call only when dst.Is4() && proxySupportsIPv4(ip)

resp, err := proxy.Request(ctx, pkt, responder)
if err != nil && strings.Contains(err.Error(), "cannot send ICMPv4 using ICMPv6 proxy") {
    return nil, errors.New("destination is IPv4 but ICMP proxy is IPv6-only; use an IPv6 target or re-init proxy")
}

When it happens

Trigger: icmpProxy.Request -> icmpEchoRoundtrip with dst being an IPv4 address while ip.srcSocketAddr is non-nil (proxy bound for ICMPv6).

Common situations: IPv4 origin behind a proxy instance set up for IPv6; dual-stack tunnel where traffic family mismatches the bound ICMP socket on Windows.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• cannot send ICMPv6 using ICMPv4 proxy
• ICMP proxy is not implemented on %s %s
• Group ID %d is not between ping group %d to %d
• did not find group range in %s
• failed to send/receive ICMPv6 echo

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/6eefb15c257d5ba8. Report an issue: GitHub.