What causes "failed to determine IPv4 source address for ICMP proxy" in cloudflare/cloudflared?

Explicitly set the source: --icmpv4-src matching an interface on the host.

failed to determine IPv4 source address for ICMP proxy

Error message

failed to determine IPv4 source address for ICMP proxy

What it means

determineICMPSources resolves the IPv4 source address the ICMP proxy will use when forwarding ping/trace packets. determineICMPv4Src fails when no explicit --icmpv4-src is given and no usable local IPv4 address can be found (or the explicitly provided one is invalid). The error is wrapped as 'failed to determine IPv4 source address for ICMP proxy'.

Source

Thrown at cmd/cloudflared/tunnel/configuration.go:372

}

func newICMPRouter(c *cli.Context, logger *zerolog.Logger) (ingress.ICMPRouterServer, error) {
	ipv4Src, ipv6Src, err := determineICMPSources(c, logger)
	if err != nil {
		return nil, err
	}

	icmpRouter, err := ingress.NewICMPRouter(ipv4Src, ipv6Src, logger, icmpFunnelTimeout)
	if err != nil {
		return nil, err
	}
	return icmpRouter, nil
}

func determineICMPSources(c *cli.Context, logger *zerolog.Logger) (netip.Addr, netip.Addr, error) {
	ipv4Src, err := determineICMPv4Src(c.String(flags.ICMPV4Src), logger)
	if err != nil {
		return netip.Addr{}, netip.Addr{}, errors.Wrap(err, "failed to determine IPv4 source address for ICMP proxy")
	}

	logger.Info().Msgf("ICMP proxy will use %s as source for IPv4", ipv4Src)

	ipv6Src, zone, err := determineICMPv6Src(c.String(flags.ICMPV6Src), logger, ipv4Src)
	if err != nil {
		return netip.Addr{}, netip.Addr{}, errors.Wrap(err, "failed to determine IPv6 source address for ICMP proxy")
	}

	if zone != "" {
		logger.Info().Msgf("ICMP proxy will use %s in zone %s as source for IPv6", ipv6Src, zone)
	} else {
		logger.Info().Msgf("ICMP proxy will use %s as source for IPv6", ipv6Src)
	}

	return ipv4Src, ipv6Src, nil
}

View on GitHub (pinned to 2253eeeb25)

Solutions

Explicitly set the source: --icmpv4-src <valid-local-ipv4> matching an interface on the host.
Ensure the host/network namespace has an IPv4 address assigned (ip addr show).
Remove the invalid --icmpv4-src value if it was a typo.
Disable ICMP proxying if the environment cannot support it.

Example fix

// before (IPv6-only container)
cloudflared tunnel run --icmpv4-src 10.0.0.5 my-tunnel
// after
ip addr add 192.168.1.10/24 dev eth0
cloudflared tunnel run --icmpv4-src 192.168.1.10 my-tunnel

Defensive patterns

Strategy: validation

Validate before calling

// verify a local IPv4 source exists before enabling ICMP
func hasIPv4Source(src string) error {
	addr, err := netip.ParseAddr(src)
	if err != nil { return err }
	if !addr.Is4() { return fmt.Errorf("%s is not IPv4", src) }
	conn, err := net.Dial("udp4", "8.8.8.8:53")
	if err != nil { return err }
	_ = conn.Close()
	return nil
}

Try / catch

ipv4Src, err := determineICMPv4Src(c.String(flags.ICMPV4Src), logger)
if err != nil {
	return netip.Addr{}, netip.Addr{}, errors.Wrap(err, "failed to determine IPv4 source address for ICMP proxy")
}

Prevention

Set --icmpv4-src explicitly on hosts with multiple interfaces
Verify the host has an IPv4 address before enabling ICMP proxying
Skip ICMP proxying in IPv6-only or sandboxed environments
Test `ping` from inside the container to confirm raw socket/addr support

When it happens

Trigger: Enabling ICMP proxying (--icmp-router / proxy functionality) on a host with no IPv4 address assigned, or passing an invalid --icmpv4-src value; running inside containers/network namespaces lacking IPv4.

Common situations: IPv6-only VMs or containers; Docker/Kubernetes pods without an IPv4 interface; typo'd --icmpv4-src CIDR/IP; sandboxed environments (e.g. some CI) without a routable v4 address.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/f82f1d0ed204a59a. Report an issue: GitHub.