Blocking traceroutes from the Internet

RouterOS General
1

I would like to block all traceroutes from the Internet to my network. I used the following rules and they don’t seem to work:

/ip firewall filter print
4 X ;;; Drop traceroutes from Internet
chain=forward action=drop protocol=icmp in-interface=ether4-inet
icmp-options=11:1

5 X ;;; Drop traceroutes from Internet
chain=forward action=drop protocol=icmp in-interface=ether4-inet
icmp-options=3:3


I’m guessing that I have the wrong “icmp-options”? What should they be? Traceroutes are still getting through on the Internet side.

2

Trace route utilities tend to depend on the TTL expired in transit message being returned but implementations use a variety of methods to stimulate those messages.

The TTL exceeded message is ICMP 11:0 - not 11:1 which is fragment reassembly time exceeded. You seem to be filtering for 11:1 at the moment. Note that these packets are returned to the originator of the trace route - i.e. they would be sent from your network outwards.