With service monitoring prometheus blackbox-exporter and an icmp module configured, every ICMP probe fails immediately (probe_success 0, ~0.1 ms duration), even against the router's own address. The exporter cannot open an ICMP socket: the systemd unit runs it as the unprivileged user node_exporter without CAP_NET_RAW, and the system default net.ipv4.ping_group_range = 1 0 also forbids unprivileged ICMP (datagram) sockets. As shipped, the icmp prober cannot work.

Steps to reproduce

set service monitoring prometheus blackbox-exporter listen-address '192.0.2.1'
set service monitoring prometheus blackbox-exporter port '9115'
set service monitoring prometheus blackbox-exporter modules icmp name icmp preferred-ip-protocol 'ipv4'
set service monitoring prometheus blackbox-exporter modules icmp name icmp timeout '3'
commit

(192.0.2.1 = any local address of the router.)

$ curl -s -G -d module=icmp -d target=192.0.2.1 -d debug=true http://192.0.2.1:9115/probe

Actual result

probe_duration_seconds 0.000111547
probe_success 0

level=INFO  source=icmp.go:108 msg="Creating socket" module=icmp target=192.0.2.1
level=ERROR source=icmp.go:187 msg="Error listening to socket" module=icmp target=192.0.2.1 err="listen ip4:icmp 0.0.0.0: socket: operation not permitted"

Expected result

probe_success 1 for a reachable target.

Analysis

Generated unit (systemctl cat blackbox_exporter.service):

[Service]
User=node_exporter
ExecStart=/usr/sbin/blackbox_exporter \
        --web.listen-address=192.0.2.1:9115 \
        --config.file=/run/blackbox_exporter/config.yml

• node_exporter is uid 126 / gid 134, with no extra groups.
• The unit sets no AmbientCapabilities, so the process has no CAP_NET_RAW for raw ICMP sockets.
• sysctl net.ipv4.ping_group_range = 1 0 (disabled), so the unprivileged ICMP datagram fallback is not allowed either.

The generated module config (/run/blackbox_exporter/config.yml) looks correct:

modules:
  icmp:
    prober: icmp
    timeout: 3s
    icmp:
      preferred_ip_protocol: "ip4"
      ip_protocol_fallback: false

Workaround (verified)

set system sysctl parameter net.ipv4.ping_group_range value '0 2147483647'
commit

After this change the probe returns probe_success 1, and cross-site probes over VTI tunnels work. This relaxes the setting for every group on the system, so it is only a workaround.

Suggested fix

Grant only the needed capability in the blackbox_exporter unit that VyOS generates:

[Service]
User=node_exporter
AmbientCapabilities=CAP_NET_RAW
CapabilityBoundingSet=CAP_NET_RAW

Alternatively, set ping_group_range to cover only the node_exporter group whenever blackbox-exporter is enabled. Either way, the ICMP module should work out of the box.

Impact

modules icmp is currently unusable without a manual sysctl change, which makes blackbox-exporter much less useful for its main purpose (reachability and latency monitoring, e.g. of IPsec/VTI peers).