PF support for IPv6 Extension Headers

Kristof Provost kp at
Thu Jun 11 13:50:02 UTC 2015

(From a very quick look at the code)

On 2015-06-10 20:57:02 (-0300), Fernando Gont <fernando at> wrote:
> What's the level f support of PF wrt IPv6 Extension Headers?
It's pretty limited. 

There's code for a few specific header types (fragment, routing, AH,
hopopts and dstopts) but nothing generic. That means that none of the
things you described (filtering per EH type, EH size or number of EHs)
are supported.

> pf.conf(5) talks about an implicit block rule for packets employing the
> routing header, ...
That appears to be only for the type 0 routing header. Packets with RH0
are always dropped, but other routing headers are left unmolested.

See .


More information about the freebsd-net mailing list