From owner-freebsd-pf@freebsd.org Fri Mar 4 02:58:53 2016 Return-Path: Delivered-To: freebsd-pf@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 03F58A9312E for ; Fri, 4 Mar 2016 02:58:53 +0000 (UTC) (envelope-from list_freebsd@bluerosetech.com) Received: from delta.brtsvcs.net (delta.brtsvcs.net [IPv6:2001:19f0:6000:8e75:5400:ff:fe14:fb98]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id E8C8819E for ; Fri, 4 Mar 2016 02:58:52 +0000 (UTC) (envelope-from list_freebsd@bluerosetech.com) Received: from chombo.houseloki.net (unknown [IPv6:2001:558:6025:4b:757f:4f8f:4dc0:401e]) by delta.brtsvcs.net (Postfix) with ESMTPS id 057004E238 for ; Fri, 4 Mar 2016 02:58:46 +0000 (UTC) Received: from [IPv6:2601:1c2:d00:3e10:baca:3aff:fe83:bd29] (unknown [IPv6:2601:1c2:d00:3e10:baca:3aff:fe83:bd29]) by chombo.houseloki.net (Postfix) with ESMTPSA id 117731F31 for ; Thu, 3 Mar 2016 18:58:41 -0800 (PST) To: freebsd-pf@freebsd.org From: Melissa Pilgrim Subject: IPv6 fragments in 10.2 Message-ID: <56D8F9E1.9060808@bluerosetech.com> Date: Thu, 3 Mar 2016 18:58:41 -0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Mar 2016 02:58:53 -0000 Now that pf in 10.2 supports IPv6 fragments, how do you configure pf to allow them? I'm still seeing UDP PMTU breakage specifically with FreeBSD and pf related to the packet filter not passing fragments. The basic "fragment reassemble" scrub rule doesn't seem to be sufficient. The man page was not updated with the commit, and I'm not having any luck with web searches.