To allow traceroute diagnostics on Windows, you must create inbound firewall rules that permit Internet Control Message Protocol (ICMP) Type 3 messages and User Datagram Protocol (UDP) traffic on high ports. The standard
tracert command relies on these specific protocols to map network paths. Without explicit rules, the Windows Defender Firewall often blocks the necessary return packets, causing the command to appear hung or fail entirely during network troubleshooting sessions.
Understanding Traceroute Protocols
Before configuring the firewall, it is essential to understand which protocols the
tracert utility utilizes. By default, Windows uses ICMP Echo Request messages with incrementing Time-To-Live (TTL) values. Each router along the path decrements the TTL; when it reaches zero, the router sends back an ICMP Type 11 (Time Exceeded) message. Additionally, if the destination is reached, an ICMP Type 0 (Echo Reply) is returned. However, some versions of traceroute or alternative tools may use UDP packets starting at port 33434 and incrementing for each hop. Therefore, a robust rule set must account for both ICMP and UDP traffic to ensure compatibility across different network environments.
Creating an ICMP Rule via Command Line
The most efficient method to configure firewall rules is using the
netsh command-line tool within an elevated Command Prompt. This approach avoids navigating through complex GUI menus and ensures the rule is applied consistently. You need administrative privileges to modify system-wide firewall settings. Open your terminal by searching for "cmd" in the Start menu, right-clicking the result, and selecting "Run as administrator."
First, create a rule that allows inbound ICMP Type 3 messages. These are Destination Unreachable messages, which are critical for diagnosing why a packet failed to reach its target. Execute the following command:
netsh advfirewall firewall add rule name="Allow ICMP Type 3 Inbound" protocol=icmpv4:3,any dir=in action=allow
Next, allow ICMP Type 11 messages, which indicate that the TTL has expired at an intermediate router. This is the core mechanism traceroute uses to identify hops. Run this command to enable those responses:
netsh advfirewall firewall add rule name="Allow ICMP Type 11 Inbound" protocol=icmpv4:11,any dir=in action=allow
Finally, allow general ICMP Echo Replies if you wish to test basic connectivity alongside tracing. While not strictly required for the hop-by-hop logic, it helps verify end-to-end reachability:
netsh advfirewall firewall add rule name="Allow ICMP Echo Reply Inbound" protocol=icmpv4:8,any dir=in action=allow
If you encounter issues with other command-line utilities like
Press any key to exit in command prompt, ensuring your environment variables and permissions are correct is just as vital as network configuration.
Configuring UDP Rules for Alternative Tracers
Some network administrators prefer UDP-based tracing because it can traverse certain asymmetric routing setups more effectively than ICMP. If your diagnostic tools rely on UDP, you must open the range of ports typically used by traceroute. The standard implementation starts at UDP port 33434 and increments for each hop up to 33534.
Create a rule to allow inbound UDP traffic on this specific range. This ensures that when your local machine sends out probes, the return traffic from intermediate routers is not dropped by the firewall. Use the following command to define this allowance:
netsh advfirewall firewall add rule name="Allow UDP Traceroute Ports" protocol=udp dir=in action=allow localport=33434-33534
This rule specifically targets the ephemeral ports used by the traceroute process. It does not expose your entire system to random UDP scans, maintaining a reasonable security posture while enabling diagnostics. For more complex batch scripting needs, such as creating delays between diagnostic steps, you might find resources on
Using 'if not exist' in batch file to create delay helpful for automating your network checks.
Verifying and Testing the Configuration
After applying the rules, verify that they have been added correctly. You can list all firewall rules containing "Traceroute" or "ICMP" to confirm their existence. Run the following command to view the details:
netsh advfirewall firewall show rule name=all | findstr /i "traceroute icmp"
Once verified, test the configuration by running a standard traceroute command against a public DNS server or a known external IP address. Open your command prompt and type:
tracert 8.8.8.8
You should see a list of hops with response times. If the trace stops abruptly after the first few hops, check your outbound firewall rules as well, although Windows typically allows outbound ICMP and UDP by default. If you experience difficulties with text processing during your diagnostics, understanding how to troubleshoot commands like
Troubleshooting findstr /X Command in Windows can assist in parsing output logs efficiently.
Frequently Asked Questions
Why does my traceroute show asterisks instead of hop IPs?
Asterisks indicate that the probe timed out, usually because the firewall blocked the return ICMP or UDP packets. Ensure your inbound rules for ICMP Type 11 and UDP ports 33434-33534 are active and allowed. Some intermediate routers may also drop ICMP messages intentionally for security reasons, which is outside your local control.
Can I use PowerShell instead of netsh to create these rules?
Yes, PowerShell provides the
New-NetFirewallRule cmdlet for managing firewall policies. For example, you can use
New-NetFirewallRule -DisplayName "Allow ICMP Type 11" -Direction Inbound -Protocol ICMPv4 -IcmpType 11 -Action Allow. This method integrates better with modern automation scripts compared to the legacy netsh syntax.
Do I need to open outbound ports for traceroute to work?
Typically, no. Windows allows outbound ICMP and UDP traffic by default. The primary issue is usually inbound traffic being blocked. However, if you are behind a strict corporate proxy or hardware firewall, you may need to consult your network administrator regarding outbound restrictions on UDP high ports.
How do I delete these firewall rules later?
To remove the rules created in this guide, use the
netsh command with the
delete option followed by the rule name. For example:
netsh advfirewall firewall delete rule name="Allow ICMP Type 11 Inbound". Ensure you run the command prompt as an administrator to execute deletions successfully.