PF with IPv6
bc979 at lafn.org
Sat May 1 04:20:57 UTC 2021
FreeBSD 13-RELEASE. I have a small test network setup and tried to block all IPv6 except those addressed to a specific address. /etc/pf.conf contained:
ext_if = "bge0"
LAN3 = "2001:1000:0:3000::/64"
pass in quick log on $ext_if proto ipv6 from $LAN3 to $LAN3
block in log on $ext_if proto ipv6 from any to any
Nothing got blocked. pftop showed all zeros for both rules. I then added at the end:
pass in quick log on $ext_if proto icmp6 from $LAN3 to $LAN3
block in log on $ext_if proto icmp6 from any to any
A lot of stuff got blocked. The log shows many entries like:
15:59:41.597632 rule 3/0(match): block in on bge0: (hlim 1, next-header Options (0) payload length: 32) fe80::120c:6bff:fe5d:4404 > ff02::1: HBH (rtalert: 0x0000) (pad1)(pad1) ICMP6, multicast listener query
0x0000: 6000 0000 0020 0001 fe80 0000 0000 0000 `...............
0x0010: 120c 6bff fe5d 4404 ff02 0000 0000 0000 ..k..]D.........
0x0020: 0000 0000 0000 0001 3a00 0502 0000 0000 ........:.......
0x0030: 8200 98aa ....
Rule 3 is the block for ICMP6, but those are clearly IP6 packets that should have been blocked by rule 1. Is there a problem with IPv6 and pf?
More information about the freebsd-questions