2

The following pf.conf (FreeBSD 10.3) appears to be blocking all IPv6 traffic and I can't work out why.

tcp_inbound = "{ ssh, domain, http, https }"
tcp_outbound = "{ domain, http, https, imaps, smtps }"

udp_services = "{ domain, ntp }"

block all
pass proto udp to any port $udp_services keep state
pass out proto tcp to any port $tcp_outbound keep state
pass in proto tcp to any port $tcp_inbound keep state

# from https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist/
table <github> { 192.30.252.0/22, 2620:112:3000::/44 }
pass out proto tcp to <github> port { ssh } keep state

pass proto icmp from any to any

How do I allow IPv6 traffic on the same services I allow for IPv4? I added explicit inet6 versions of each rule and it didn't seem to help. If I disable pf then the IPv6 traffic gets through fine.

dpk
  • 181
  • 1
  • 6

1 Answers1

6

By enabling logging I managed to work out that this is because the ICMP6 router solicitation was being blocked. Adding

pass proto ipv6-icmp from any to any

to the end of the file fixed the problem.

dpk
  • 181
  • 1
  • 6