ipfilter strangeness with ipv6-icmp
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 16 Jun 2022 16:59:34 UTC
I'm using ipf to secure a FreeBSD 13.1 system that receives its IPV6 address via Router Advertisements. When setting up my IPV6 rules I placed a ipv6-icmp rule to allow all packets in. However the Router Advertisements were still blocked. I found I had to specifically allow icmp-type routerad. This seems like a bug or I'm not understanding what the unadorned version of the ipv6-icmp rule does. The following is an abbreviated version of the relevant IPV6 ipf rules: ====== /etc/ipf.rules (abbreviated) ========== #V6 eth0 Block in by default and allow all out block in on eth0 family inet6 head 200 pass out quick on eth0 family inet6 all keep state # ICMP try to allow all but log the blocks in case some don't work correctly block in log proto ipv6-icmp from any to any group 200 # router advertisements fail with following rule pass in quick family inet6 proto ipv6-icmp from any to any group 200 # router advertisements succeed with following rule and fail if commented out pass in log quick family inet6 proto ipv6-icmp from any to any icmp-type routerad group 200 ============================================== The logs show the final pass being the rule that matched. I can't understand why the previous general one fails. It is not the expected behavior. I spent a few hours looking through both the ipf source files to see how things are parsed and encoded and also the ipfilter kernel module. I was unable to see where/how the icmp-type any was implemented. I also looked around for the best place to post this and didn't find one. Darren Reed's site for IPFilter seems down and the official mailing list is no more. Let me know if there is a better forum. Best regards, Bob