Fix outbound ICMP time exceeded block on Windows Server

Windows Server firewall silently drops ICMP time-exceeded packets, breaking traceroute. Fix by enabling File and Printer Sharing rules or adding a custom allow rule.

The 30-Second Fix: Enable the Built-In Rule

What's actually happening here is Windows Firewall on Server Core (and some Desktop Experience installs) ships with the File and Printer Sharing (Echo Request – ICMPv4-In) rule disabled by default. That rule only covers inbound echo requests, but the outbound Time Exceeded messages generated by your router when a TTL expires are getting filtered too. Microsoft's built-in Core Networking – Destination Unreachable and Time Exceeded rules are present but not bound to any profile unless you explicitly enable them.

Open Windows Defender Firewall with Advanced Security (run wf.msc).
Click Inbound Rules in the left pane.
Scroll to File and Printer Sharing (Echo Request – ICMPv4-In).
Right-click it and select Enable Rule.

That fixes inbound pings, but here's the catch — traceroute sends UDP packets and expects ICMP time-exceeded replies from intermediate routers, not from your server itself. The server only sends time-exceeded when it is the router. If you're running a VPN gateway or RRAS, this rule matters. For a plain file server, the block is on the outbound side — so skip ahead if this didn't help.

The 5-Minute Fix: Create a Custom Outbound Allow Rule

The reason step 1 often doesn't work is that Windows Firewall treats outbound ICMP time-exceeded as part of the Core Networking group, which is usually set to Block for outbound by default on Server SKUs. You can't just toggle the built-in ones because they're pre-defined as Allow only if the profile is Domain and you've changed the default outbound action.

In the same wf.msc window, click Outbound Rules.
Click New Rule… on the right.
Choose Custom, then Next.
Leave All programs, next.
Set Protocol type: to ICMPv4, then click Customize….
Under ICMP types, select Specific ICMP types and check Time Exceeded.
Click OK, then Next.
Leave Any IP address for both local and remote, Next.
Select Allow the connection, Next.
Check all three profiles (Domain, Private, Public), name it Allow Outbound ICMP Time Exceeded, finish.

This is the exact rule that fixes traceroute from a Windows Server acting as a router or NAT device. If you're testing from a workstation to your server, this rule won't change anything because the time-exceeded is coming from the network path, not the server.

The 15+ Minute Fix: Check Service Dependencies and Group Policy

If the custom rule still doesn't work, the problem isn't the firewall rule — it's the IP Helper service or a GPO that's overriding local rules. I've seen this on Server 2019 after a domain join where the default Domain Policy forces outbound ICMP to block, ignoring local admin rules.

Step 1: Verify IP Helper is running

Traceroute relies on ICMP time-exceeded being generated by the IP stack. If iphlpsvc is disabled, Windows won't send those packets even if the firewall allows them. Check it:

Get-Service iphlpsvc | Select Status, StartType

If it's not Running, set it to Automatic and start it:

Set-Service iphlpsvc -StartupType Automatic
Start-Service iphlpsvc

Step 2: Query the actual firewall rules

Don't trust the GUI — sometimes a hidden rule with a higher weight is blocking. Use netsh to see what's really applied:

netsh advfirewall firewall show rule name=all dir=out status=enabled | findstr /i "ICMP Time Exceeded"

If you see a block rule for Core Networking – Time Exceeded, delete it or set it to allow:

netsh advfirewall firewall set rule name="Core Networking - Time Exceeded" new enable=yes action=allow

Step 3: Check Group Policy overrides

Local firewall rules don't apply if a GPO sets Windows Firewall: Allow inbound remote administration exception or overrides the outbound default with Block. Run gpresult /h gp.html and open it to see which policies touch firewall settings. The culprit is usually Computer Configuration\Administrative Templates\Network\Network Connections\Windows Firewall\Domain Profile — if Windows Firewall: Allow ICMP exceptions is Disabled, that kills it.

Fix it in Group Policy Management Editor on your DC: set that policy to Enabled, then run gpupdate /force on the server.

Step 4: Confirm with a packet capture

If you're still stuck, capture traffic before and after the fix to see if the packets leave the host:

netsh trace start capture=yes
pathping -n 8.8.8.8
netsh trace stop

The reason this matters is that a block might be happening in the Windows Filtering Platform (WFP) at a layer lower than the firewall service — that's when you see error 0x80070422 in the event log. WFP callout drivers from third-party security software (like some AV suites) can silently drop ICMP even when Windows Firewall rules say allow. Uninstall the AV trial, or at least disable its firewall module, then test.

Real-world trigger: You've just deployed Windows Server 2022 as a NAT router for a lab, and your network admins complain they can't run tracert past your gateway. Everything else works — HTTP, DNS, even ping. That's the classic silhouette of this block.

One more thing — if you're using Azure or AWS, the block might be in the network security group, not the OS. Check the NSG rules for outbound ICMP. Those platforms often deny ICMP by default because some scanners abuse it, and they don't expose it in the portal like other protocols.

The fix I keep coming back to on Server 2016 through 2022 is the custom outbound rule from the 5-minute section. It's explicit, it's scoped to only the time-exceeded type (so you're not opening up all ICMP), and it survives Windows updates. The GUI toggle for the echo request is a trap — it feels like the solution but only addresses half the problem.