cloudflare/cloudflared · error

ICMP proxy is not implemented on %s %s

Error message

ICMP proxy is not implemented on %s %s

What it means

cloudflared builds a fallback ICMP proxy on platforms/ architectures where a native packet-socket ICMP proxy is not implemented. This stub proxy returns errICMPProxyNotImplemented for every Request and Serve call, so the error simply means 'ICMP proxying is unavailable on this platform' (message interpolates runtime.GOOS/GOARCH).

Source

Thrown at ingress/icmp_generic.go:17

//go:build !darwin && !linux && (!windows || !cgo)

package ingress

import (
	"context"
	"fmt"
	"net/netip"
	"runtime"
	"time"

	"github.com/rs/zerolog"

	"github.com/cloudflare/cloudflared/packet"
)

var errICMPProxyNotImplemented = fmt.Errorf("ICMP proxy is not implemented on %s %s", runtime.GOOS, runtime.GOARCH)

type icmpProxy struct{}

func (ip icmpProxy) Request(ctx context.Context, pk *packet.ICMP, responder ICMPResponder) error {
	return errICMPProxyNotImplemented
}

func (ip *icmpProxy) Serve(ctx context.Context) error {
	return errICMPProxyNotImplemented
}

func newICMPProxy(listenIP netip.Addr, logger *zerolog.Logger, idleTimeout time.Duration) (*icmpProxy, error) {
	return nil, errICMPProxyNotImplemented
}

View on GitHub (pinned to 2253eeeb25)

Solutions

  1. Verify you are on a supported platform (linux/amd64, linux/arm64, windows, darwin); if not, rebuild cloudflared for a supported OS/arch.
  2. Reinstall the official release binary matching your platform instead of a source build that compiled in the stub icmp_generic.go.
  3. If ICMP proxying is genuinely unavailable, disable ICMP routing for the tunnel (remove icmp/UDP ingress rules) and route only TCP/HTTP traffic.
  4. For Linux, ensure the runtime supports packet sockets and you have the needed capabilities (CAP_NET_RAW) so the real proxy is chosen at startup.
  5. If the platform is required, contribute/implement a native icmpProxy for that GOOS/GOARCH; the stub is only a placeholder.

Example fix

// before (unsupported platform, stub selected by build tags)
GOOS=freebsd GOARCH=arm64 make cloudflared   # uses ingress/icmp_generic.go stub
// after
GOOS=linux GOARCH=amd64 make cloudflared     # real ICMP proxy implementation
Defensive patterns

Strategy: fallback

Validate before calling

if strings.Contains(proxyErr.Error(), "ICMP proxy is not implemented") {
    // platform lacks ICMP proxying; disable ICMP routing or rebuild for a supported GOOS/GOARCH
}

Type guard

func icmpProxySupported(goos, goarch string) bool {
    switch goos {
    case "linux", "windows", "darwin":
        return true
    default:
        return false
    }
}

Try / catch

if err := proxy.Request(ctx, pkt, responder); err != nil {
    if errors.Is(err, errICMPProxyNotImplemented) {
        log.Warn().Msg("ICMP proxying unavailable on this platform; skipping")
        return nil // or fallback to non-ICMP transport
    }
    return fmt.Errorf("icmp request failed: %w", err)
}

Prevention

When it happens

Trigger: Running cloudflared with ICMP/UDP proxy features on an OS/arch combination that has no native icmpProxy implementation (e.g. non-Linux/non-Windows/non-macOS builds, or unsupported architectures); any tunnel request that routes an ICMP packet to the stub icmpProxy.Request, or starting proxying via icmpProxy.Serve.

Common situations: Deploying cloudflared on unusual platforms (BSD, ARM variants without support) and using `cloudflared access` / WARP-style ICMP routing; building from source for an architecture where per-OS icmp_linux.go/icmp_windows.go/icmp_darwin.go files are excluded by build tags.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/31a6f7350bea83d2. Report an issue: GitHub.