Traceroute or similar tools (mtr, tracepath) can't be used through passt, because we don't propagate IP level TTL values to our outgoing sockets. I believe it would be possible to do this by: * Using the IP_TTL socket option to propagate the TTL from UDP packets received on the tap interface to the outgoing UDP sockets * Using IP_RECVERR on outward facing UDP sockets to detect time exceeded erorrs and propagate them to the guest with synthesized ICMP packets.