PF is blocking IPv6 in/out

[tier1]

Have found pf is preventing ipv6 both directions.

When pf is enabled cannot ping6 anything beyond the FreeBSD server.

Current pf.conf for ipv6:

web="{ 80, 443, 8096 }"
ssh="{ 10069 }"

pass log on $ext_if inet6 proto tcp from any to any port ftp \
    flags S/SA keep state \
    (max-src-conn 25, max-src-conn-rate 25/5, \
     overload <bruteforce> flush global)
    
     pass in on $public inet6 proto tcp from any to any port $web flags S/SA keep state
     pass in on $ext_if inet6 proto tcp from any to any port $ssh flags S/SA synproxy state \
        (max-src-conn-rate 9/15, overload <naughty> flush global)

Thanks in advance for your help.

 

[bds]

ping6 sends (and listens for) ICMPv6 packets. Your pf.conf seems to be concerned with IPv6 TCP traffic. You may need to add some "proto icmp6" rules for ping6 to work.