[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
ipv6 ipfilter with icmp6 and keep state
I am trying to use ipfilter for ipv6 with icmpv6 and keep state.
If there are no firewall rules entered the router is working properly. If
you add a 'pass in on' rule without 'keep state' should work icmpv6 also.
If you try a keep-state rule ipv6 icmp packets discarded.
vlan927: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
vlan: 927 parent: ixg0
inet6 fe80::a236:9fff:fe27:4330%vlan927 prefixlen 64 scopeid 0xc
inet6 2001:638:902:201b::1 prefixlen 64
ping from 2001:638:902:2000::xxx to 2001:638:902:201b::xxxx works.
now add 'pass in on vlan927 from 2001:638:902:201b::/64 to 2000::/3'
ping from 2001:638:902:2000::xxx to 2001:638:902:201b::xxx works also.
now replace the rule with 'pass in on vlan927 from 2001:638:902:201b::/64
to 2000::/3 keep state'
ipfstat -i -o -6
# empty list for ipfilter(out)
pass in on vlan927 inet6 from 2001:638:902:201b::/64 to 2000::/3 keep state
ping from from 2001:638:902:2000::xxx to 2001:638:902:201b::xxx is
Can someone explain the behavior or is it in an error of ipfilter?
Thank your for your efforts
Main Index |
Thread Index |