I see pf manual, there is a section description:
So if I run pf with empty rule does it could filter such packets?
It seems not work. IGMP packet with options still pass the filter.
How should I set filter rule?
Code:
allow-opts
By default, IPv4 packets with IP options or IPv6 packets with rout-
ing extension headers are blocked. When allow-opts is specified
for a pass rule, packets that pass the filter based on that rule
(last matching) do so even if they contain IP options or routing
extension headers. For packets that match state, the rule that
initially created the state is used. The implicit pass rule that
is used when a packet does not match any rules does not allow IP
options.So if I run pf with empty rule does it could filter such packets?
It seems not work. IGMP packet with options still pass the filter.
How should I set filter rule?