FreeBSD Jail Allow Ping / tracerouter Commands

To allow ping and traceroute commands inside a FreeBSD jail, you will need to modify the jail’s configuration to allow ICMP traffic.

1. Edit the jail’s configuration file:
   sudo vi /etc/jail.conf

2. Add the following line to the configuration file, replacing jail_name with the name of your jail:
   exec.start += "sh /etc/rc.initial.jail_name"


   This line will execute the script /etc/rc.initial.jail_name when the jail starts.

3. Create the script /etc/rc.initial.jail_name with the following content:
   #!/bin/sh

   # Enable ICMP
sysctl net.inet.icmp.icmplim=0


   This script sets the net.inet.icmp.icmplim system variable to 0, which allows unlimited ICMP traffic to and from the jail.

4. Restart the jail:
   sudo /etc/rc.d/jail restart jail_name


After completing these steps, the jail should allow ping and traceroute commands to be executed inside it. Note that allowing ICMP traffic in this way may decrease the security of the jail, so you should carefully consider the implications of this change before implementing it.