I can PING an IP but traceroute (with ICMP) times out

[zemanek]

I can PING an IP that's behind policy-based IPsec VPN, but when I try trace route (web UI) with ICMP method, it times out.

Am I missing something?

I tried pfctl -d / traceroute / pfctl -e via command line, but that does not work either.