Frank Stuehmer wrote:

in earlier versions of SuSEfirewall there was a parameter FW_ALLOW_FW_TRACEROUTE.

In version 3.3 isn't. I could use FW_ALLOW_INCOMING_HIGHPORTS_UDP but it's deprecated. How may I allow to traceroute the firewall?

The feature FW_ALLOW_FW_TRACEROUTE provided is no longer needed as the OUTPUT chain doesn't DROP anything anymore. FW_ALLOW_FW_TRACEROUTE never opened the necessary udp ports to make traceroute work, you always had to do that yourself. You do not want to use FW_ALLOW_INCOMING_HIGHPORTS_UDP though as that would open even more ports than actually required. You may use FW_SERVICES_EXT_UDP for opening the required port range. cu Ludwig -- (o_ Ludwig Nussel //\ SUSE LINUX Products GmbH, Development V_/_ http://www.suse.de/