What causes "cannot send ICMPv6 using ICMPv4 proxy" in cloudflare/cloudflared?

Ensure the proxy is initialized for IPv6 as well so srcSocketAddr is set (check how cloudflared was launched and which local ICMP socket it bound).

cloudflare/cloudflared · error

cannot send ICMPv6 using ICMPv4 proxy

Error message

cannot send ICMPv6 using ICMPv4 proxy

What it means

On Windows the ICMP proxy picks either the ICMPv4 IcmpSendEcho API path or the ICMPv6 Icmp6SendEcho path based on how its source socket was opened. icmpEchoRoundtrip raises this error when an ICMPv6 packet arrives but the proxy was created for IPv4 only (srcSocketAddr is nil), so it cannot handle v6 echo requests.

Source

Thrown at ingress/icmp_windows.go:334

			TTL:      packet.DefaultTTL,
		},
		Message: &icmp.Message{
			Type: replyType,
			Code: icmpEchoReplyCode,
			Body: &icmp.Echo{
				ID:   echoReq.ID,
				Seq:  echoReq.Seq,
				Data: resp.payload(),
			},
		},
	}
	return responder.ReturnPacket(&pk)
}

func (ip *icmpProxy) icmpEchoRoundtrip(dst netip.Addr, echo *icmp.Echo) (echoResp, error) {
	if dst.Is6() {
		if ip.srcSocketAddr == nil {
			return nil, fmt.Errorf("cannot send ICMPv6 using ICMPv4 proxy")
		}
		resp, err := ip.icmp6SendEcho(dst, echo)
		if err != nil {

			return nil, errors.Wrap(err, "failed to send/receive ICMPv6 echo")
		}
		return resp, nil
	}
	if ip.srcSocketAddr != nil {
		return nil, fmt.Errorf("cannot send ICMPv4 using ICMPv6 proxy")
	}
	resp, err := ip.icmpSendEcho(dst, echo)
	if err != nil {
		return nil, errors.Wrap(err, "failed to send/receive ICMPv4 echo")
	}
	return resp, nil
}

View on GitHub (pinned to 2253eeeb25)

Solutions

Ensure the proxy is initialized for IPv6 as well so srcSocketAddr is set (check how cloudflared was launched and which local ICMP socket it bound).
Force the origin/destination to resolve to an IPv4 address (use A records or an IPv4 address for the tunneled host) so requests match the ICMPv4 proxy.
Restart cloudflared on a host/network with IPv6 connectivity so the ICMPv6 path can be established.
Check Windows network stack and firewall to confirm ICMPv6 is available if v6 routing is intended.

Example fix

// before: proxy created v4-only, request dst = 2001:db8::1 -> error
// after: route an IPv4 destination to the v4 proxy
resp, err := proxy.Request(ctx, icmpPacketTo(ipv4Dst), responder)

Defensive patterns

Strategy: validation

Validate before calling

if pkt.Dst.Is6() && proxy.SrcSocketAddr == nil {
    // resolve to IPv4 or re-init proxy with ICMPv6 socket before calling Request
}

Type guard

func proxySupportsIPv6(p *icmpProxy) bool { return p.srcSocketAddr != nil }
// call only when dst.Is6() && proxySupportsIPv6(ip)

Try / catch

resp, err := proxy.Request(ctx, pkt, responder)
if err != nil && strings.Contains(err.Error(), "cannot send ICMPv6 using ICMPv4 proxy") {
    return nil, errors.New("destination is IPv6 but ICMP proxy is IPv4-only; use an IPv4 target or re-init proxy")
}

Prevention

Match destination address family to the proxy's bound socket family before sending.
Set up both ICMPv4 and ICMPv6 sockets when dual-stack traffic is expected.
Pin tunnel origins to IPv4 (A records) if only the v4 proxy is available.
Log the bound socket family at proxy startup to catch mismatches early.

When it happens

Trigger: icmpProxy.Request -> icmpEchoRoundtrip with dst being an IPv6 address while the proxy instance has no ICMPv6 source socket (ip.srcSocketAddr == nil).

Common situations: Tunnel origin resolving to an AAAA record (IPv6) while cloudflared's Windows ICMP proxy was set up for IPv4; mixed dual-stack traffic routed to a v4-only proxy instance.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/1c7418dc7915fb91. Report an issue: GitHub.