- Tue 06 February 2018
- misc
It's a super easy thing to fat finger or flake out on, but an IPv6 firewall rule such as:
root@testhost:~# grep icmp /etc/ipf/ipf6.conf
pass in quick proto icmp from any to any
pass out quick proto icmp from any to any
root@testhost:~#
isn't going to have the desired effect, though it may load just fine.
Why is that?
Well, it's an IPv6 ruleset. And ICMP (IP protocol 1) and ICMP-for-IPv6 (IP protocol 58) aren't the same thing though they may accomplish a lot of the same things.
Here's an IPv6 ruleset that does what you expect:
root@testhost:~# grep icmp /etc/ipf/ipf6.conf
pass in quick proto ipv6-icmp from any to any
pass out quick proto ipv6-icmp from any to any
root@testhost:~#