IPv6 ICMP is not ICMP


  • Tue 06 February 2018
  • misc

It's a super easy thing to fat finger or flake out on, but an IPv6 firewall rule such as:

root@testhost:~# grep icmp /etc/ipf/ipf6.conf 
pass in quick proto icmp from any to any
pass out quick proto icmp from any to any
root@testhost:~# 

isn't going to have the desired effect, though it may load just fine.

Why is that?

Well, it's an IPv6 ruleset. And ICMP (IP protocol 1) and ICMP-for-IPv6 (IP protocol 58) aren't the same thing though they may accomplish a lot of the same things.

Here's an IPv6 ruleset that does what you expect:

root@testhost:~# grep icmp /etc/ipf/ipf6.conf 
pass in quick proto ipv6-icmp from any to any
pass out quick proto ipv6-icmp from any to any
root@testhost:~#