Trace internal equipement from Internet while answering

Question

I would like to know if it's possible to achieve a traceroute of nodes on an internal network from an equipement on the internet answering to a query.

Let's say that a client on an internal network send query to a server on the internet, http server for example.

Is it possible for this server to achieve a traceroute by sending serveral time its response, starting with a TTL of 1 and incrementing it for each response ?

From my point of view, packet should be accepted by the NAT router of the client and redirected on the internal network because it's a response. And so, it could be possible for the server to get TTL expiration responses and IP address from the internals nodes.

Answer 1

Probably not.

The routers in the internal network will likely generate time exceeded messages. The question is what happens to those messages when they reach the NAT. I see three main possibilities.

1. The NAT forwards them without changing their source address (with or without fixing up the embedded packet copy).
2. The NAT forwards them, but changes their source address to the external address associated with the connection.
3. The NAT drops them.

In case 1 a trace into the internal network is theoretically possible, but in practice it is likely to end up blocked by ingress filtering on the internet side.

In case 2 you can determine how many hops there were in the internal network, but not the addresses of those hops.

In Case 3 you get nothing.

Answer 2

For this to work, you need two things:

1. The application on the server needs to be able to manipulate the TTL without affecting the function of the app. In other words, the app needs to continue to function even though it gets Time Exceeded errors.

2. The target network firewall needs to allow Time Exceeded messages to the Internet.

Answer 3

Internal and external networks(internet network) is segregated with L3 devices like perimeter devices router or firewalls. if traceroute protocol is allowed in perimeter devices for outbound traffic policy in firewall then you can traceroute internet hosted server from internal network.