Troubleshooting Traceroute Output¶

When traceroute is run from LAN to a destination on the Internet, the firewall itself may be missing from the traceroute output depending on the configuration.

This happens on Multi-WAN due to the way that route-to and reply-to work. policy routing (route-to/reply-to) does not decrease the IP TTL when forwarding packets, so the firewall does not appear as a hop.

This may also happen with IPsec due to the way IPsec traffic is handled in the kernel. The traffic is not “routed” in a traditional sense.