Traceroute doesn't work from static IP addresses

The traceroute utility doesn't work when executed from a host using an IP address from an optional static IP address block. Ironically, traceroute does work when executed from a host using a private IP address (i.e., in the 192.168.1.0/24 block) through the Residential Gateway's NAT.

The problem appears to be a bug in the RG's filtering firewall that blocks the returning ICMP messages that traceroute uses to identify intermediate hops even when all firewalling is supposedly turned off. When full logging is turned on in the RG, the following incriminating messages appear in its log:

Jan  8 15:41:09 uverse 75.60.237.94: INF 2010-01-08T15:41:06-08:00 fw,fwmon: src=151.164.42.192 dst=75.60.237.89 ipprot=1 icmp_type=11 icmp_code=0 ICMP Packet Error, Dropped

ipprot 1 is ICMP; icmp type 11 is Time Exceeded; icmp code 0 (when icmp type is 11) is TTL expired in transit.

This is a good example of the kinds of problems that could be so easily avoided if the Residential Gateway were to act as a simple transparent bridge for all static IP traffic.

Last modified: Tue Jan 12 20:08:44 PST 2010