What causes "failed to determine IPv6 source address for ICMP proxy" in cloudflare/cloudflared?

Set an explicit valid source: --icmpv6-src (optionally %zone).

failed to determine IPv6 source address for ICMP proxy

Error message

failed to determine IPv6 source address for ICMP proxy

What it means

The IPv6 counterpart of determineICMPSources: determineICMPv6Src fails to resolve the IPv6 source address (and optional zone) for the ICMP proxy, using the already-resolved IPv4 source as a hint. The failure is wrapped as 'failed to determine IPv6 source address for ICMP proxy' and aborts ICMP router creation.

Source

Thrown at cmd/cloudflared/tunnel/configuration.go:379

	icmpRouter, err := ingress.NewICMPRouter(ipv4Src, ipv6Src, logger, icmpFunnelTimeout)
	if err != nil {
		return nil, err
	}
	return icmpRouter, nil
}

func determineICMPSources(c *cli.Context, logger *zerolog.Logger) (netip.Addr, netip.Addr, error) {
	ipv4Src, err := determineICMPv4Src(c.String(flags.ICMPV4Src), logger)
	if err != nil {
		return netip.Addr{}, netip.Addr{}, errors.Wrap(err, "failed to determine IPv4 source address for ICMP proxy")
	}

	logger.Info().Msgf("ICMP proxy will use %s as source for IPv4", ipv4Src)

	ipv6Src, zone, err := determineICMPv6Src(c.String(flags.ICMPV6Src), logger, ipv4Src)
	if err != nil {
		return netip.Addr{}, netip.Addr{}, errors.Wrap(err, "failed to determine IPv6 source address for ICMP proxy")
	}

	if zone != "" {
		logger.Info().Msgf("ICMP proxy will use %s in zone %s as source for IPv6", ipv6Src, zone)
	} else {
		logger.Info().Msgf("ICMP proxy will use %s as source for IPv6", ipv6Src)
	}

	return ipv4Src, ipv6Src, nil
}

func determineICMPv4Src(userDefinedSrc string, logger *zerolog.Logger) (netip.Addr, error) {
	if userDefinedSrc != "" {
		addr, err := netip.ParseAddr(userDefinedSrc)
		if err != nil {
			return netip.Addr{}, err
		}
		if addr.Is4() {

View on GitHub (pinned to 2253eeeb25)

Solutions

Set an explicit valid source: --icmpv6-src <valid-global-ipv6> (optionally %zone).
Ensure the host has a routable IPv6 address (ip -6 addr show).
Fix or remove a bad --icmpv6-src / zone value.
If the environment is IPv4-only, rely on the IPv4 path only and avoid forcing IPv6 ICMP.

Example fix

// before
cloudflared tunnel run --icmpv6-src fe80::1%eth9 my-tunnel
// after
cloudflared tunnel run --icmpv6-src 2001:db8::10%eth0 my-tunnel

Defensive patterns

Strategy: validation

Validate before calling

// verify a routable IPv6 source exists before enabling ICMP
func hasIPv6Source(src string) error {
	addr, err := netip.ParseAddr(strings.Split(src, "%")[0])
	if err != nil { return err }
	if !addr.Is6() || addr.IsLinkLocalUnicast() && src == "" {
		return fmt.Errorf("%s is not a usable global IPv6 source", src)
	}
	return nil
}

Try / catch

ipv6Src, zone, err := determineICMPv6Src(c.String(flags.ICMPV6Src), logger, ipv4Src)
if err != nil {
	return netip.Addr{}, netip.Addr{}, errors.Wrap(err, "failed to determine IPv6 source address for ICMP proxy")
}

Prevention

Set --icmpv6-src explicitly on dual-stack or multi-interface hosts
Confirm a global (not link-local) IPv6 address exists via `ip -6 addr`
Validate the zone suffix matches a real interface name
Accept IPv4-only ICMP in IPv4-only environments

When it happens

Trigger: Enabling ICMP proxying on a host with no global IPv6 address, or an invalid --icmpv6-src value (bad address or nonexistent zone like 'eth9').

Common situations: Hosts with only link-local IPv6 and no global address; specifying a zone that doesn't exist; IPv4-only servers; firewalls/network policies disabling IPv6.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/f852fd3c10ebbf36. Report an issue: GitHub.