PF Issue with PF and IPv6

M

myuserid

I run 15.1-RELEASE-p2 on an old laptop with pf configured as follows:

Code: 
set block-policy drop
set skip on lo0
scrub in all fragment reassemble
block in all
pass out quick all keep state
antispoof for wlan0
pass in proto tcp to any port ssh keep state
pass in proto tcp to any port http keep state
pass in proto udp to any port mdns

Basically, I want the outbound traffic unlimited and the inbound traffic limited to a few ports plus replies to outbound queries.

This works fine as long as my Wi-Fi interface uses only IPv4, but if I enable IPv6, I encounter time outs making the system unusable.
For instance, when I run pkg update, pkg contacts pkg.freebsd.org using IPv6 but times out waiting for a reply.
If I disable PF, pkg update works like a charm.

There must be some obvious error in my configuration, but as a beginner, I can't see it and could use some help.
 
AI says pf handles ivp6 differently when it comes to ICMP. It suggest you try this:
Code: 
set block-policy drop
set skip on lo0
scrub in all fragment reassemble
block in all

# 1. Allow essential ICMPv6 traffic (Neighbor Discovery, Packet Too Big, Ping, etc.)
pass in quick on wlan0 inet6 proto icmp6 keep state

# 2. Allow ICMP for IPv4
pass in quick on wlan0 inet proto icmp keep state

pass out quick all keep state
antispoof for wlan0

pass in proto tcp to any port ssh keep state
pass in proto tcp to any port http keep state
pass in proto udp to any port mdns
 
Unfortunately, it doesn't help. I've also bought "The book of PF", which didn't help either.
Out of despair, I tried IPFW and it worked first time!
The following configuration in /etc/rc.conf does exactly what I want:
Code: 
firewall_enable=YES
firewall_type=workstation
firewall_myservices="22/tcp 80/tcp 5353/udp"
firewall_allowservices="192.168.1.0/24 fe80::/64 my:ipv6:pre:fix::/64"
 
myuserid said:
Unfortunately, it doesn't help. I've also bought "The book of PF", which didn't help either.
Out of despair, I tried IPFW and it worked first time!
The following configuration in /etc/rc.conf does exactly what I want:
Code: 
firewall_enable=YES
firewall_type=workstation
firewall_myservices="22/tcp 80/tcp 5353/udp"
firewall_allowservices="192.168.1.0/24 fe80::/64 my:ipv6:pre:fix::/64"
Click to expand...
I'm glad you found something that worked, but I think the issue is that you didn't have any actual IPV6 rules in the original configuration. I don't personally use IPV6, but I'm fairly sure that block blocks all traffic and that you didn't have any rules to let IPV6 traffic in.
For example for icmp traffic:
pass in on $int_if inet6 proto icmp6 allow-opts
As opposed to the IPV4 version:
pass in on $int_if inet proto icmp

I'm not at all an expert on it and you may be happier with IPFW if that's working for you, but this should be the path you're looking for if you want to use PF.
 
On my little $2/month VPS, they assigned me eight ipv6 addresses and two ipv4. Looking at their pricing sheet, they don't do that anymore but I think I'm considered a legacy user.
I've never used the ipv6 addresses but I need to turn them on cause the tide has turned.
 
hedwards said:
I'm glad you found something that worked, but I think the issue is that you didn't have any actual IPV6 rules in the original configuration. I don't personally use IPV6, but I'm fairly sure that block blocks all traffic and that you didn't have any rules to let IPV6 traffic in.
For example for icmp traffic:
pass in on $int_if inet6 proto icmp6 allow-opts
As opposed to the IPV4 version:
pass in on $int_if inet proto icmp

I'm not at all an expert on it and you may be happier with IPFW if that's working for you, but this should be the path you're looking for if you want to use PF.
Click to expand...
I've also tried to duplicate my PF pass rules adding inet on one and inet6 on the other, but it didn't help.
 
You must log in or register to reply here.
Back
Top