From nobody Sun Apr 19 20:10:15 2026 X-Original-To: freebsd-ipfw@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4fzKVZ4yv8z6ZMTZ for ; Sun, 19 Apr 2026 20:10:30 +0000 (UTC) (envelope-from freebsd@gushi.org) Received: from prime.gushi.org (prime.gushi.org [IPv6:2620:137:6000:10::142]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "prime.gushi.org", Issuer "E8" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4fzKVY425Vz42qy for ; Sun, 19 Apr 2026 20:10:29 +0000 (UTC) (envelope-from freebsd@gushi.org) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gushi.org header.s=prime2014 header.b=Ra+Cyh9p; dmarc=pass (policy=none) header.from=gushi.org; spf=pass (mx1.freebsd.org: domain of freebsd@gushi.org designates 2620:137:6000:10::142 as permitted sender) smtp.mailfrom=freebsd@gushi.org Received: from smtpclient.apple (not.afront.org [50.126.75.182]) (authenticated bits=0) by prime.gushi.org (8.18.1/8.18.1) with ESMTPSA id 63JKAPlu023824 (version=TLSv1.2 cipher=ECDHE-ECDSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 19 Apr 2026 20:10:25 GMT (envelope-from freebsd@gushi.org) DKIM-Filter: OpenDKIM Filter v2.10.3 prime.gushi.org 63JKAPlu023824 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gushi.org; s=prime2014; t=1776629426; bh=DWBd1+JdK+/ghIxi/FLRKA7KSGGrGh7Vsiz4VEjtWyQ=; h=From:Subject:Date:In-Reply-To:Cc:To:References; z=From:=20"Dan=20Mahoney=20(ports)"=20|Subject:= 20Re:=20rule=20for=20any=20IPv6=20address|Date:=20Sun,=2019=20Apr= 202026=2013:10:15=20-0700|In-Reply-To:=20<78129E7F-4FED-4DB5-9FD6- 542BA4430657@gushi.org>|Cc:=20freebsd-ipfw@freebsd.org|To:=20Marco =20Moock=20|References:=20<20260419120755.784eb26e@ des.dorfdsl.de>=0D=0A=20<78129E7F-4FED-4DB5-9FD6-542BA4430657@gush i.org>; b=Ra+Cyh9pWS4HQ72Xd8gkpaDoDC6507SD/PW+gusd3BEvuXTc4aGfQppxtOVkUzJFW XSgd/9s+Wc4EaP+0Tvrrre7B7kh8YHgup1lV+370i9g7/t0WWmtDMJrlN+iTfEw0VF hW61Y8O5dBKXKxlc3vi4oIDsBYJcbDFEh8AyvnKSBKbKM2AA5iJve2WKkexIp2c4fT ktFx0dL+ysBna7fxCnE7FpyXNFGeyGYlqx0pmjRkcNaD8OB21HA5CErxq5lZ+sKulQ RnJj7NP54flOYhrYS+ApLDwEHECTHmchdC+V7nnN2vGwq2HQQsSlkNJE4WmwQ4Lwh9 BaDoPr6ntlUBw== X-Authentication-Warning: prime.gushi.org: Host not.afront.org [50.126.75.182] claimed to be smtpclient.apple From: "Dan Mahoney (ports)" Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_DE63CAE9-98C7-4723-B15D-EDB891F7FF85" List-Id: IPFW Technical Discussions List-Archive: https://lists.freebsd.org/archives/freebsd-ipfw List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-ipfw@FreeBSD.org Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.500.181\)) Subject: Re: rule for any IPv6 address Date: Sun, 19 Apr 2026 13:10:15 -0700 In-Reply-To: <78129E7F-4FED-4DB5-9FD6-542BA4430657@gushi.org> Cc: freebsd-ipfw@freebsd.org To: Marco Moock References: <20260419120755.784eb26e@des.dorfdsl.de> <78129E7F-4FED-4DB5-9FD6-542BA4430657@gushi.org> X-Mailer: Apple Mail (2.3864.500.181) X-Spamd-Result: default: False [-4.80 / 15.00]; NEURAL_HAM_LONG(-1.00)[-1.000]; DWL_DNSWL_LOW(-1.00)[gushi.org:dkim]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_SHORT(-1.00)[-0.998]; DMARC_POLICY_ALLOW(-0.50)[gushi.org,none]; R_DKIM_ALLOW(-0.20)[gushi.org:s=prime2014]; R_SPF_ALLOW(-0.20)[+mx]; ONCE_RECEIVED(0.20)[]; MIME_GOOD(-0.10)[multipart/alternative,text/plain]; HAS_XAW(0.00)[]; RCVD_TLS_ALL(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; DKIM_TRACE(0.00)[gushi.org:+]; ARC_NA(0.00)[]; RCVD_COUNT_ONE(0.00)[1]; RCVD_VIA_SMTP_AUTH(0.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:~]; FROM_EQ_ENVFROM(0.00)[]; FROM_HAS_DN(0.00)[]; ASN(0.00)[asn:393507, ipnet:2620:137:6000::/44, country:US]; TO_MATCH_ENVRCPT_SOME(0.00)[]; MID_RHS_MATCH_FROM(0.00)[]; MLMMJ_DEST(0.00)[freebsd-ipfw@freebsd.org]; APPLE_MAILER_COMMON(0.00)[]; TO_DN_SOME(0.00)[] X-Rspamd-Queue-Id: 4fzKVY425Vz42qy X-Spamd-Bar: ---- --Apple-Mail=_DE63CAE9-98C7-4723-B15D-EDB891F7FF85 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Apr 19, 2026, at 1:06=E2=80=AFPM, Dan Mahoney (ports) = wrote: >=20 > Whoops, sent from wrong address. >=20 >> On Apr 19, 2026, at 3:07=E2=80=AFAM, Marco Moock = wrote: >>=20 >> Hello! >>=20 >> # ipfw add 01000 allow tcp from ::/0 to me 80 >> 01000 allow tcp from me6 to me 80 >=20 >=20 > # ipfw add 65500 allow ip6 from any to me 80 proto tcp > 65500 allow ip6 from any to me6 80 proto tcp >=20 > note that the kernel then interprets me as "me6" since it knows it's = an ipv6 me. >=20 > Yeah, it might be useful if there was aliases for: >=20 > allow tcp6 from any to me, that under the hood got rendered as: >=20 > allow ip6 from any to me6 proto tcp >=20 > But yeah, this seems to be The Way. >=20 > Also note that while reading the manpage for this, I found a weird = mention of "inner" protocols that I pushed a docbug for. >=20 > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D294648 Oh, also, the fact that your ipfw interpreted ::/0 as "me6" also feels = like a bug. Perhaps someone else could comment on that. -Dan --Apple-Mail=_DE63CAE9-98C7-4723-B15D-EDB891F7FF85 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On Apr 19, 2026, at 1:06=E2=80=AFPM, Dan Mahoney = (ports) <freebsd@gushi.org> wrote:

Whoops, sent from wrong = address.

On Apr 19, 2026, at = 3:07=E2=80=AFAM, Marco Moock <mm@dorfdsl.de> wrote:

Hello!

# ipfw add = 01000 allow tcp from ::/0 to me 80
01000 allow tcp from me6 to me = 80

# ipfw = add 65500 allow ip6 from any to me 80 proto tcp
65500 allow = ip6 from any to me6 80 proto tcp

note that the = kernel then interprets me as "me6" since it knows it's an ipv6 = me.

Yeah, it might be useful if there was = aliases for:

allow tcp6 from any to me, that = under the hood got rendered as:

allow ip6 from = any to me6 proto tcp

But yeah, this seems to be = The Way.

Also note that while reading the = manpage for this, I found a weird mention of "inner" protocols that I = pushed a docbug for.

=

Oh, also, the fact that your ipfw = interpreted ::/0 as "me6" also feels like a bug.  Perhaps someone = else could comment on = that.

-Dan

= --Apple-Mail=_DE63CAE9-98C7-4723-B15D-EDB891F7FF85--