Date: Fri, 30 Apr 2021 21:20:48 -0700 From: Doug Hardie <bc979@lafn.org> To: FreeBSD Questions <freebsd-questions@freebsd.org> Subject: PF with IPv6 Message-ID: <2CD4806C-F1A4-4DDE-8C2F-2B0A08EA2A18@sermon-archive.info>
next in thread | raw e-mail | index | archive | help
FreeBSD 13-RELEASE. I have a small test network setup and tried to block all IPv6 except those addressed to a specific address. /etc/pf.conf contained: ext_if = "bge0" LAN3 = "2001:1000:0:3000::/64" pass in quick log on $ext_if proto ipv6 from $LAN3 to $LAN3 block in log on $ext_if proto ipv6 from any to any Nothing got blocked. pftop showed all zeros for both rules. I then added at the end: pass in quick log on $ext_if proto icmp6 from $LAN3 to $LAN3 block in log on $ext_if proto icmp6 from any to any A lot of stuff got blocked. The log shows many entries like: 15:59:41.597632 rule 3/0(match): block in on bge0: (hlim 1, next-header Options (0) payload length: 32) fe80::120c:6bff:fe5d:4404 > ff02::1: HBH (rtalert: 0x0000) (pad1)(pad1) ICMP6, multicast listener query 0x0000: 6000 0000 0020 0001 fe80 0000 0000 0000 `............... 0x0010: 120c 6bff fe5d 4404 ff02 0000 0000 0000 ..k..]D......... 0x0020: 0000 0000 0000 0001 3a00 0502 0000 0000 ........:....... 0x0030: 8200 98aa .... Rule 3 is the block for ICMP6, but those are clearly IP6 packets that should have been blocked by rule 1. Is there a problem with IPv6 and pf? -- Doug
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?2CD4806C-F1A4-4DDE-8C2F-2B0A08EA2A18>