From nobody Sun Apr 19 20:06:41 2026 X-Original-To: freebsd-ipfw@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4fzKQT5jdGz6ZLst for ; Sun, 19 Apr 2026 20:06:57 +0000 (UTC) (envelope-from freebsd@gushi.org) Received: from prime.gushi.org (prime.gushi.org [IPv6:2620:137:6000:10::142]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "prime.gushi.org", Issuer "E8" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4fzKQT2H6gz42kY for ; Sun, 19 Apr 2026 20:06:57 +0000 (UTC) (envelope-from freebsd@gushi.org) Authentication-Results: mx1.freebsd.org; none Received: from smtpclient.apple (not.afront.org [50.126.75.182]) (authenticated bits=0) by prime.gushi.org (8.18.1/8.18.1) with ESMTPSA id 63JK6piN022763 (version=TLSv1.2 cipher=ECDHE-ECDSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 19 Apr 2026 20:06:52 GMT (envelope-from freebsd@gushi.org) DKIM-Filter: OpenDKIM Filter v2.10.3 prime.gushi.org 63JK6piN022763 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gushi.org; s=prime2014; t=1776629212; bh=ixp4UG+ZZY5OKmRD+zf41yZlqzUdJ8RXxRJ1biz/GGc=; h=From:Subject:Date:In-Reply-To:Cc:To:References; z=From:=20"Dan=20Mahoney=20(ports)"=20|Subject:= 20Re:=20rule=20for=20any=20IPv6=20address|Date:=20Sun,=2019=20Apr= 202026=2013:06:41=20-0700|In-Reply-To:=20<20260419120755.784eb26e@ des.dorfdsl.de>|Cc:=20freebsd-ipfw@freebsd.org|To:=20Marco=20Moock =20|References:=20<20260419120755.784eb26e@des.dorf dsl.de>; b=t864mj7JdLdtZu7yBehhRS5XAwjSxxMHw+I7fw1KjNugpYMoMf8CL3vPm8A5dsU+l NKtAt//wKLj8ua4hONK0XRqV7aprzWfv6FWEkGxlMSka3suzXD031/p4gzg39AnG2T Ko+SgNobE/73o1+972R8FvtXHzaYyewT9d81Lp0ZC2x7FIXAy0oIr76HiyKt0Q3LFc S6+3EFMkrdHNOkGW4vS1uQGgSyKtbRk3nWercJREoaskNqCU0T00nglZ+GQ2OfCYeE DfHsum3uK8ePLuREKZTuUNwMYo8SM+pO+rUdHpOmtpX91A9SdvLOngw7lnQQ6nHMtn 2ge7Knz1hRCtw== X-Authentication-Warning: prime.gushi.org: Host not.afront.org [50.126.75.182] claimed to be smtpclient.apple From: "Dan Mahoney (ports)" Message-Id: <78129E7F-4FED-4DB5-9FD6-542BA4430657@gushi.org> Content-Type: multipart/alternative; boundary="Apple-Mail=_AF0942F0-BB82-4E82-B158-7927A3F87BAF" List-Id: IPFW Technical Discussions List-Archive: https://lists.freebsd.org/archives/freebsd-ipfw List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-ipfw@FreeBSD.org Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.500.181\)) Subject: Re: rule for any IPv6 address Date: Sun, 19 Apr 2026 13:06:41 -0700 In-Reply-To: <20260419120755.784eb26e@des.dorfdsl.de> Cc: freebsd-ipfw@freebsd.org To: Marco Moock References: <20260419120755.784eb26e@des.dorfdsl.de> X-Mailer: Apple Mail (2.3864.500.181) X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:393507, ipnet:2620:137:6000::/44, country:US] X-Rspamd-Queue-Id: 4fzKQT2H6gz42kY X-Spamd-Bar: ---- --Apple-Mail=_AF0942F0-BB82-4E82-B158-7927A3F87BAF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Whoops, sent from wrong address. > On Apr 19, 2026, at 3:07=E2=80=AFAM, Marco Moock = wrote: >=20 > Hello! >=20 > # ipfw add 01000 allow tcp from ::/0 to me 80 > 01000 allow tcp from me6 to me 80 # ipfw add 65500 allow ip6 from any to me 80 proto tcp 65500 allow ip6 from any to me6 80 proto tcp note that the kernel then interprets me as "me6" since it knows it's an = ipv6 me. Yeah, it might be useful if there was aliases for: allow tcp6 from any to me, that under the hood got rendered as: allow ip6 from any to me6 proto tcp But yeah, this seems to be The Way. Also note that while reading the manpage for this, I found a weird = mention of "inner" protocols that I pushed a docbug for. https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D294648= --Apple-Mail=_AF0942F0-BB82-4E82-B158-7927A3F87BAF Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Whoops, sent from wrong = address.

On Apr 19, 2026, at = 3:07=E2=80=AFAM, Marco Moock <mm@dorfdsl.de> wrote:

Hello!

# ipfw add = 01000 allow tcp from ::/0 to me 80
01000 allow tcp from me6 to me = 80

# ipfw = add 65500 allow ip6 from any to me 80 proto tcp
65500 allow = ip6 from any to me6 80 proto tcp

note that the = kernel then interprets me as "me6" since it knows it's an ipv6 = me.

Yeah, it might be useful if there was = aliases for:

allow tcp6 from any to me, that = under the hood got rendered as:

allow ip6 from = any to me6 proto tcp

But yeah, this seems to be = The Way.

Also note that while reading the = manpage for this, I found a weird mention of "inner" protocols that I = pushed a docbug for.

= --Apple-Mail=_AF0942F0-BB82-4E82-B158-7927A3F87BAF--