Destination net unreachable

For IP forwarding through the BIG-IP, not necessarily forward (web) proxy, you need:

1. that the client's default route be the self-IP of the BIG-IP

    

2. that the BIG-IP's default route be the outbound router IP

    

3. that you have an IP forwarding VIP listening on all IPs/ports/protocols, that it has port and address translation disabled, and optionally SNAT enabled

    

4. that the client has a way to locally resolve DNS

    

So when a client (browser) attempts to connect to it first does a DNS resolution and gets back 104.219.105.148. Because the BIG-IP is its default outbound route, the client passes the request to the BIG-IP. The BIG-IP, because it has an IP forwarding wildcard VIP, receives this request and forwards it to its default route (and optionally applies source address translation).

If you can see the client's traffic arriving at the client side of the BIG-IP, then you know the client is properly configured. If you see the client's traffic leaving the BIG-IP to the outbound router, then you're reasonably sure the BIG-IP VIP is properly configured. As Ed states, ICMP may be getting held up because your VIP wasn't listening on UDP. Otherwise ICMP isn't an indicator of a good or bad configuration. You need to look at the actual client and server traffic through the proxy.