From owner-freebsd-net@FreeBSD.ORG Wed Jul 22 08:18:52 2009 Return-Path: Delivered-To: net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DDAC9106566B for ; Wed, 22 Jul 2009 08:18:52 +0000 (UTC) (envelope-from wjw@digiware.nl) Received: from mail.digiware.nl (mail.ip6.digiware.nl [IPv6:2001:4cb8:1:106::2]) by mx1.freebsd.org (Postfix) with ESMTP id 7B4B58FC08 for ; Wed, 22 Jul 2009 08:18:52 +0000 (UTC) (envelope-from wjw@digiware.nl) Received: from localhost (localhost.digiware.nl [127.0.0.1]) by mail.digiware.nl (Postfix) with ESMTP id 00FCF153436 for ; Wed, 22 Jul 2009 10:18:51 +0200 (CEST) X-Virus-Scanned: amavisd-new at digiware.nl Received: from mail.digiware.nl ([127.0.0.1]) by localhost (rack1.digiware.nl [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f+AsjkiOIKkJ; Wed, 22 Jul 2009 10:18:48 +0200 (CEST) Received: from [192.168.10.67] (opteron [192.168.10.67]) by mail.digiware.nl (Postfix) with ESMTP id C5447153435 for ; Wed, 22 Jul 2009 10:18:48 +0200 (CEST) Message-ID: <4A66CBE2.6050606@digiware.nl> Date: Wed, 22 Jul 2009 10:20:50 +0200 From: Willem Jan Withagen Organization: Digiware User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: net@freebsd.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: Subject: IPv6 and ipfw X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2009 08:18:53 -0000 Hi, Running 7.2 I tried to insert this into my IPFW rules # ipfw add allow udp from any to 2001:xxx:3::113,2001:xxxx:3::116 \ dst-port 10001-10100 keep-state ipfw: bad netmask ``xxxx:3::113'' also: # ipfw add allow udp from any to trixbox.ip6 dst-port 10001-10100 keep-state ipfw: hostname ``trixbox.ip6'' unknown Exit 68 # host trixbox.ip6 trixbox.ip6.digiware.nl has IPv6 address 2001:4cb8:3::116 So it looks like what is in the manual is overly optimistic: ---- addr6-list: ip6-addr[,addr6-list] ip6-addr: A host or subnet specified one of the following ways: numeric-ip | hostname Matches a single IPv6 address as allowed by inet_pton(3) or a hostname. Hostnames are resolved at the time the rule is added to the firewall list. addr/masklen Matches all IPv6 addresses with base addr (specified as allowed by inet_pton or a hostname) and mask width of masklen bits. No support for sets of IPv6 addresses is provided because IPv6 addresses are typically random past the initial prefix. ---- Anybody else ran into this? Or should I file this as a PR. --WjW