PF Issue with PF and IPv6

M

myuserid

I run 15.1-RELEASE-p2 on an old laptop with pf configured as follows:

Code: 
set block-policy drop
set skip on lo0
scrub in all fragment reassemble
block in all
pass out quick all keep state
antispoof for wlan0
pass in proto tcp to any port ssh keep state
pass in proto tcp to any port http keep state
pass in proto udp to any port mdns

Basically, I want the outbound traffic unlimited and the inbound traffic limited to a few ports plus replies to outbound queries.

This works fine as long as my Wi-Fi interface uses only IPv4, but if I enable IPv6, I encounter time outs making the system unusable.
For instance, when I run pkg update, pkg contacts pkg.freebsd.org using IPv6 but times out waiting for a reply.
If I disable PF, pkg update works like a charm.

There must be some obvious error in my configuration, but as a beginner, I can't see it and could use some help.
 
AI says pf handles ivp6 differently when it comes to ICMP. It suggest you try this:
Code: 
set block-policy drop
set skip on lo0
scrub in all fragment reassemble
block in all

# 1. Allow essential ICMPv6 traffic (Neighbor Discovery, Packet Too Big, Ping, etc.)
pass in quick on wlan0 inet6 proto icmp6 keep state

# 2. Allow ICMP for IPv4
pass in quick on wlan0 inet proto icmp keep state

pass out quick all keep state
antispoof for wlan0

pass in proto tcp to any port ssh keep state
pass in proto tcp to any port http keep state
pass in proto udp to any port mdns
 
Unfortunately, it doesn't help. I've also bought "The book of PF", which didn't help either.
Out of despair, I tried IPFW and it worked first time!
The following configuration in /etc/rc.conf does exactly what I want:
Code: 
firewall_enable=YES
firewall_type=workstation
firewall_myservices="22/tcp 80/tcp 5353/udp"
firewall_allowservices="192.168.1.0/24 fe80::/64 my:ipv6:pre:fix::/64"
 
myuserid said:
Unfortunately, it doesn't help. I've also bought "The book of PF", which didn't help either.
Out of despair, I tried IPFW and it worked first time!
The following configuration in /etc/rc.conf does exactly what I want:
Code: 
firewall_enable=YES
firewall_type=workstation
firewall_myservices="22/tcp 80/tcp 5353/udp"
firewall_allowservices="192.168.1.0/24 fe80::/64 my:ipv6:pre:fix::/64"
Click to expand...
I'm glad you found something that worked, but I think the issue is that you didn't have any actual IPV6 rules in the original configuration. I don't personally use IPV6, but I'm fairly sure that block blocks all traffic and that you didn't have any rules to let IPV6 traffic in.
For example for icmp traffic:
pass in on $int_if inet6 proto icmp6 allow-opts
As opposed to the IPV4 version:
pass in on $int_if inet proto icmp

I'm not at all an expert on it and you may be happier with IPFW if that's working for you, but this should be the path you're looking for if you want to use PF.
 
On my little $2/month VPS, they assigned me eight ipv6 addresses and two ipv4. Looking at their pricing sheet, they don't do that anymore but I think I'm considered a legacy user.
I've never used the ipv6 addresses but I need to turn them on cause the tide has turned.
 
hedwards said:
I'm glad you found something that worked, but I think the issue is that you didn't have any actual IPV6 rules in the original configuration. I don't personally use IPV6, but I'm fairly sure that block blocks all traffic and that you didn't have any rules to let IPV6 traffic in.
For example for icmp traffic:
pass in on $int_if inet6 proto icmp6 allow-opts
As opposed to the IPV4 version:
pass in on $int_if inet proto icmp

I'm not at all an expert on it and you may be happier with IPFW if that's working for you, but this should be the path you're looking for if you want to use PF.
Click to expand...
I've also tried to duplicate my PF pass rules adding inet on one and inet6 on the other, but it didn't help.
 
myuserid said:
It turns out loveydovey was right from the start!
I wrongly assumed ICMP was just for ping, in reality it is MANDATORY.
I added the ICMP rules and PF worked.
Click to expand...
That sort of thing is part of why I've never bothered with IPv6, the other bit being that even if I did convert over to IPV6 internally, there would still be issues at my modem as my ISP has extremely unclear support for IPv6.

I don't get the feeling that IPv6 is really that hard to work with, but if you're not needing it the tooling for IPv4 is quite good now with the exception of those N:M NAT arrangments that you're often times forced into when the ISP only gives you one IP to work with and it being a changeable one.
 
hedwards said:
That sort of thing is part of why I've never bothered with IPv6, the other bit being that even if I did convert over to IPV6 internally, there would still be issues at my modem as my ISP has extremely unclear support for IPv6.

I don't get the feeling that IPv6 is really that hard to work with, but if you're not needing it the tooling for IPv4 is quite good now with the exception of those N:M NAT arrangments that you're often times forced into when the ISP only gives you one IP to work with and it being a changeable one.
Click to expand...
I was promised IPv6 when I still rode a horse instead of car.
elrond-lotr.gif


Now it is sort of here. And I was excited because now my ISP can give me Public Address for free with no hassle.
Nope. F_ckers keep changing it.

Congrats to loveydovey and his AI servant for solving the pf mishap for OP.
 
DanielBowman said:
I was promised IPv6 when I still rode a horse instead of car.
View attachment 26904

Now it is sort of here. And I was excited because now my ISP can give me Public Address for free with no hassle.
Nope. F_ckers keep changing it.

Congrats to loveydovey and his AI servant for solving the pf mishap for OP.
Click to expand...
If I had IPv6 that functioned properly at home, I'd probably bump the priority on learning this stuff up on my list of stuff to do, but I don't really get why everybody doesn't just get an IPv6 range for their own home these days and until that happens you're likely to not see as many resources for people outside of enterprise being created to tell us how to use it. Or reason to use it.
 
hedwards said:
If I had IPv6 that functioned properly at home, I'd probably bump the priority on learning this stuff up on my list of stuff to do, but I don't really get why everybody doesn't just get an IPv6 range for their own home these days and until that happens you're likely to not see as many resources for people outside of enterprise being created to tell us how to use it. Or reason to use it.
Click to expand...
To be clear, I want static IPv6 on my home ISP modem/router. My LAN remains IPv4, because I do not care about setting up DNS and I sure as hell can't remember, even guess IPv6 addresses.
But I solved it by using Tailscale on my always on, low wattage ARM machine, which can route the traffic from my phone or laptop if need be and wake-on-lan whatever I need to access at home. It can also power-cycle my modem automatically if it can't reach outside for some reason.

Tailscale is even more secure than poking VPN holes in to my firewall, which sucks as it is.
 
myuserid said:
Not explicitly. I didn't specify any address restriction in my rules, so I suppose it's allowed?
Click to expand...

Sometimes allowing fe80::/10 useful for testing and sometimes you need additional rule, if your connection uses dhcpv6, like this:
Code: 
pass in on egress inet6 proto udp from fe80::/10 port dhcpv6-server to fe80::/10 port dhcpv6-client no state
 
You must log in or register to reply here.
Back
Top