Re: IPFilter 5 and IPv4-mapped IPv6 adresses

[Mike Pumford <mpumford%mudcovered.org.uk@localhost>]

On 22/07/2019 12:08, Greg Troxel wrote:

> I heard that the v4/v6 rules were unified, but I still see a -6 flag to
> ipfstat.
v4 and v6 rules are unified. They have been since NetBSD 7. I had to 
deal with this when I migrated from 6-7 a long time ago. You can no 
longer have an ipf.conf and an ipf6.conf you have to bring the 2 files 
together into one.

I can't speak for ipfilter in 8 as my 8.x firewall is based on NPF but 
in 7.x I've got IPv4 and IPv6 rules coexisting in the same group with no 
specific logic to deal with ipv4 mapped addresses.

Looking at my config I've got 2 groups on the firewall interface. The in 
group which starts:

# Group 205 incoming packets on Internet (currently pppoe0)
block in log on pppoe0 all head 205
block in log quick from 127.0.0.0/8 to any group 205
block in log quick from 10.0.0.0/8 to any group 205
block in log quick from 192.168.0.0/16 to any group 205
block in log quick from 172.16.0.0/12 to any group 205

Followed by pass in quick tcp and udp state rules to allow the inbound 
connections I want. In most cases I have 2 rules for each inbound port. 
One for the hosts v4 address and one for the v6 address. e.g

pass in quick proto tcp from any to <internal_v4_address> port = 993 
flags S keep state group 205
pass in quick proto tcp from any to <v6_address> flags S keep state 
group 205



On the outbound side I have:

block out on pppoe0 all head 255
block out from 127.0.0.0/8 to any group 255
block out from any to 127.0.0.0/8 group 255
# Then a few specific rules blocking all outbound traffic on a few 
tcp/udp ports to prevent credential leaking I then have:
pass out quick proto tcp all flags S keep state keep frag group 255
pass out quick proto udp all keep state keep frag group 255
pass out quick proto icmp all keep state group 255
pass out quick proto ipv6-icmp all keep state group 255

To allow any remaining ipv4 and ipv6 traffic to pass out of the 
firewall. I've not noticed any oddities with ipv4 mapped addresses. If 
you are using NAT use the inside addresses in the ipf rules. as the NAT 
is applied to input frames before the rules are applied on input. The 
NAT is applied after filtering for outbound frames.


Hope this helps you puzzle out your config.