Preventing a Cisco router from appearing in a traceroute

Question

I am trying to prevent a Cisco 2911 router's IP address from appearing in an inbound traceroute. I have configured the line:

no ip unreachables

on the Internet-facing interface, and while this successfully prevents a response to a traceroute probe when the destination is the router itself, it does NOT prevent the router from showing up in a traceroute to hosts behind the router. I am desiring to prevent the router from showing up not only in the typical, standard ICMP traceroutes but also 'tcptraceroute' and anything else that would completely trace the route into the network and to the destination.

I am vaguely aware of some kind of access list configuration whereby one would block the ICMP unreachables (and others) and then apply it to the interface, with perhaps trusted hosts added as exceptions. If this is indeed the way to do this, how would I configure my Cisco?

Has anyone implemented something similar to this and, if so, how? If not, how would you propose to do this?

Answer 1

You don't block the icmp unreachables - which are sent by your router - but the inbound packets sent by the traceroute or other tool, that have a TTL (time to live) of 1. See e.g. Cisco Guide to Harden Cisco IOS Devices - look for the section " Filter on TTL Value"

edit: corrected url

edit: note that in that Cisco document the example filters everything with a TTL < 6. This way you also prevent the next 4 hops in your network to appear in the traceroute without having to add an ACL to those routers as well (assuming all traffic passes through the router you are configuring). Also note that the number 6 is just an arbitrary example, you should use a value based on the diameter of your network (maximum number of hops a packet might traverse within your network). An added benefit of this is that traceroute will still work within your network.

edit: Please note that as Brendan notes in the comments, some protocols like BGP, IGMP, ... may require you to make exemptions in the ACL as they use low TTL values.

Answer 2

You will need to block the ICMP "time-exceeded" messages in order to keep the router from showing up in traceroute output.