Why Traceroute Dies in One Direction Over a VPN Tunnel

Traceroute output that completes in one direction and prints rows of asterisks in the other looks like asymmetric forwarding, and it usually is not. Each displayed hop needs the probe to arrive, a router to decide to answer, and the answer to travel back and be matched to the probe. Break any one of those links and the row becomes a star while the tunnel keeps carrying data.

The trace is evidence about diagnostics before it is evidence about transport. The question worth asking is which of the three links failed, and that answer comes from the packets rather than from the shape of the output.

An Asterisk Is a Missing Answer, Not a Missing Hop

Traceroute walks outward by sending probes whose TTL expires one router further each round. A router that discards an expired probe is supposed to return an ICMP Time Exceeded message naming itself, and the tool prints that name. What the tool actually waits for is that message arriving inside a timeout. If the router answers from a different source address, limits how often it generates errors, or drops the probe without a word, the round yields nothing printable.

None of those outcomes says the forward path is broken. A star is a report about unanswered mail, not about an empty road.

Probe Method Decides Which Filter You Meet

The default method on Linux is usually a high-numbered UDP destination port, Windows tracert sends ICMP echoes, and Linux can be told to use ICMP or TCP instead. Each of those looks like a different kind of traffic to a stateful firewall or a cloud security group. Comparing a UDP trace from one side with an ICMP trace from the other compares two different experiments. Pin the method, the address family, the source address and the timeout before you call the results a difference.

For a fair comparison, run the trace from the hosts that actually carry the traffic rather than from a gateway forwarding on their behalf. A router-generated trace uses the router's own source address and output policy, which can be stricter than anything a client sees. Record the exact invocation so the next person can repeat it.

The timeout value is the other half of the experiment, and it is easy to leave out of the notes. A two-second wait on a congested path reports stars where a five-second wait reports hops. Keep the value identical across runs so the comparison stays about the network.

The Return Path Is a Route of Its Own

An ICMP error is an ordinary packet with its own source and destination, and it needs a route back to the tracer. If the tunnel policy carries the LAN prefixes but not the router address that generated the error, the message leaves by a path that cannot reach you. Reply filtering can drop it even when the route exists, since the packet arrives from an unexpected address on an unexpected interface. That is a mismatch in the diagnostic plane rather than an application failure.

Widening every selector until the trace completes makes the picture prettier and the policy worse. Repair the specific diagnostic address, or accept the star and test the application another way.

Confirm the Tunnel With a Real Request

A TCP handshake on the service's own port exercises forwarding, return routing and filtering in the direction that matters. The commands below run on both ends and compare what each side can open. Substitute the service port and tunnel interface name from your own setup.

traceroute -I -n -w 2 203.0.113.40
traceroute -T -p 443 -n -w 2 203.0.113.40
curl -sS -o /dev/null -w '%{http_code} %{time_total}\n' --max-time 5 http://203.0.113.40:8080/health
ss -tan state established

Read the two traceroute runs first: if the ICMP run shows hops and the TCP run does not, the difference is method, not path. Then take the curl result as the application-level answer, because a completed exchange with a sensible status code means forward and return paths both work for real traffic. The socket listing shows whether the connection is established at all, which no trace can tell you.

A tunnel that carries an interactive session in both directions while one traceroute prints stars is healthy and merely unphotogenic. Keep the command output from each side as the record, and treat missing hops as an open question about diagnostics rather than a verdict about the VPN.