PF with IPv6

[Doug Hardie]

FreeBSD 13-RELEASE.  I have a small test network setup and tried to block all IPv6 except those addressed to a specific address.  /etc/pf.conf contained:

ext_if = "bge0"
LAN3 = "2001:1000:0:3000::/64"
pass in quick log on $ext_if proto ipv6 from $LAN3 to $LAN3
block in log on $ext_if proto ipv6 from any to any

Nothing got blocked.  pftop showed all zeros for both rules.  I then added at the end:

pass in quick log on $ext_if proto icmp6 from $LAN3 to $LAN3
block in log on $ext_if proto icmp6 from any to any

A lot of stuff got blocked.  The log shows many entries like:

15:59:41.597632 rule 3/0(match): block in on bge0: (hlim 1, next-header Options (0) payload length: 32) fe80::120c:6bff:fe5d:4404 > ff02::1: HBH (rtalert: 0x0000) (pad1)(pad1) ICMP6, multicast listener query
	0x0000:  6000 0000 0020 0001 fe80 0000 0000 0000  `...............
	0x0010:  120c 6bff fe5d 4404 ff02 0000 0000 0000  ..k..]D.........
	0x0020:  0000 0000 0000 0001 3a00 0502 0000 0000  ........:.......
	0x0030:  8200 98aa                                ....

Rule 3 is the block for ICMP6, but those are clearly IP6 packets that should have been blocked by rule 1.  Is there a problem with IPv6 and pf?


-- Doug