• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

2.4.4 ICMPv6 Firewall Rules?

IPv6
9
50
17.9k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    JKnott
    last edited by Dec 2, 2018, 3:07 AM

    @beremonavabi said in 2.4.4 ICMPv6 Firewall Rules?:

    All I'm doing is not allowing them to come into the WAN interface from the outside

    What part of essential do you not understand? They're used on the WAN link just as on the LAN. There is already protection to keep them from coming from beyond an adjacent device through the hop limit, which must be 255 on a valid ICMPv6 message. Fire up Wireshark or Packet Capture on the WAN port to see them. You'll see they are intended for your firewall and have a hop limit of 255. The way that works is if the packet has a hop limit of 255, it can't have come from any other than the adjacent device. For it to have passed through a router, it would have entered the router with a hop limit of 0, which the router would then discard. If a packet with any other hop limit makes it through the router, it would have a value other than 255, which would also caused it to be discarded as invalid. You're trying to protect against a problem that doesn't exist.

    PfSense running on Qotom mini PC
    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
    UniFi AC-Lite access point

    I haven't lost my mind. It's around here...somewhere...

    B 1 Reply Last reply Dec 2, 2018, 4:27 AM Reply Quote 0
    • B
      beremonavabi
      last edited by beremonavabi Dec 2, 2018, 3:37 AM Dec 2, 2018, 3:28 AM

      Neighbor Advertisement
      Neighbor Solicitation
      Redirect
      Router Advertisement
      Router Solicitation

      As far as I can see, all of those are solely of use on the local network (one, single segment -- which is all I have):

      https://www.computernetworkingnotes.com/networking-tutorials/ipv6-neighbor-discovery-protocol-explained.html

      AFAIK, they're used on the WAN link only if I have other subnets that communicate through that interface,
      I don't. To me, the outside of the WAN interface is just the internet. And, nothing on the internet should legitimately be sending those to enter my WAN link (again, that I know of). And, as you've said, if something did, it should be discarded by pfSense as it entered. Nothing of mine is on anything but the LAN. AFAIK, the only adjacent devices I care about are internal to the LAN and will happily send those ICMP packets across the LAN without interference. Why would I want to add rules to my WAN's firewall so those packets can come in when I could more easily just leave them off and, with no effort on my part, ensure they never get in regardless of whether or not pfSense should drop them anyway because of the 255 hop limit?

      Can you give me a concrete example of how my not allowing those ICMP subtypes into my WAN interface from the internet is breaking anything? That's a real question. I honestly can't think of anything on the internet that would need "a set of messages and processes defined in RFC 4861 that determine relationships between neighboring nodes" (from that link, above) on my local network. But, I'm not an expert.

      SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

      J 1 Reply Last reply Dec 2, 2018, 1:16 PM Reply Quote 0
      • B
        beremonavabi @JKnott
        last edited by beremonavabi Dec 2, 2018, 4:33 AM Dec 2, 2018, 4:27 AM

        @jknott

        Perhaps we're focusing on different elements. I'm focusing on what's allowed into the LAN. Are you worried about what's happening at the pfSense level? Here are my current rules:

        WAN:
        login-to-view

        I can't see why any of those Neighbor Discover subtypes should be allowed into LAN net (the first rule). But, are you saying they need to be allowed into the WAN address (the second rule)? By blocking them there, am I preventing pfSense from finding external neighbors and routes?

        SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

        1 Reply Last reply Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz Dec 2, 2018, 5:30 AM Dec 2, 2018, 5:28 AM

          You can put the rules there all you want - the hidden rules are hidden ;) And are going to happen before you..

          How exactly is your firewall going to talk to the internet via IPv6 on the wan if you do not allow those - so its gateway can be found.. Um you do not need to allow anything other then echo through to your lan from the internet.. etc..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          1 Reply Last reply Reply Quote 1
          • J
            JKnott @beremonavabi
            last edited by Dec 2, 2018, 1:16 PM

            @beremonavabi said in 2.4.4 ICMPv6 Firewall Rules?:

            As far as I can see, all of those are solely of use on the local network (one, single segment -- which is all I have):

            I just ran Packet Capture on my WAN interface and saw NS & NA messages. They are there because they are needed. As Johnpoz says, you can't block them anyway. So, what exactly is it you're trying to do? IPv6 relies much more on ICMP than IPv4 and quite frankly won't work without it. Perhaps you need to learn a bit more about IPv6. I can recommend O'Reilly's IPv6 Essentials.

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            1 Reply Last reply Reply Quote 1
            • J
              johnpoz LAYER 8 Global Moderator
              last edited by Dec 2, 2018, 1:29 PM

              Just at a loss to understanding what he is attempting to do..

              The required icmpv6 stuff for ipv6 to work on wan - is there!!! Same goes for lan side for clients to find pfsense as their ipv6 gateway.. There is NOTHING you need to add..

              All other to wan would be blocked out of the gate - if you want to allow actual ping response.. Then you can add that.. Same sort of thing goes if you want to allow into your lan from outside..

              Example I allow echoreq into my my ntp server IPv6 address from internet.. And to ping pfsense IPv6 wan side IP, etc. There is little reason to add any other rules..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              1 Reply Last reply Reply Quote 1
              • B
                beremonavabi
                last edited by Dec 2, 2018, 3:47 PM

                According to:

                https://www.netgate.com/docs/pfsense/book/network/ipv6-subnets.html?highlight=icmpv6#neighbor-discovery

                "...pfSense automatically adds firewall rules on IPv6 enabled interfaces that permit NDP to function. "

                Am I supposed to be able to see that rule in my Firewall rules (I don't)? Or is it just an implied rule like the default deny on incoming traffic? Does that statement imply we don't need to add any special ICMPv6 rule at all?

                SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                S J 2 Replies Last reply Dec 2, 2018, 3:57 PM Reply Quote 2
                • S
                  sigi @beremonavabi
                  last edited by Dec 2, 2018, 3:57 PM

                  @beremonavabi Maybe you should go once to cli or "Diagnostics / Command Prompt" and execute
                  "pfctl -s rules" this will help you understand about hidden rules..

                  B 1 Reply Last reply Dec 2, 2018, 4:20 PM Reply Quote 1
                  • J
                    johnpoz LAYER 8 Global Moderator @beremonavabi
                    last edited by Dec 2, 2018, 4:07 PM

                    @beremonavabi said in 2.4.4 ICMPv6 Firewall Rules?:

                    "...pfSense automatically adds firewall rules on IPv6 enabled interfaces that permit NDP to function. "

                    You have ZERO add which is what have been telling you ;)

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    1 Reply Last reply Reply Quote 0
                    • B
                      beremonavabi @sigi
                      last edited by beremonavabi Dec 3, 2018, 12:24 AM Dec 2, 2018, 4:20 PM

                      @sigi said in 2.4.4 ICMPv6 Firewall Rules?:

                      @beremonavabi Maybe you should go once to cli or "Diagnostics / Command Prompt" and execute
                      "pfctl -s rules" this will help you understand about hidden rules..

                      Thanks. According to that:

                      Shell Output - pfctl -s rules
                      ...
                      pass quick inet6 proto ipv6-icmp all icmp6-type unreach keep state
                      pass quick inet6 proto ipv6-icmp all icmp6-type toobig keep state
                      pass quick inet6 proto ipv6-icmp all icmp6-type neighbrsol keep state
                      pass quick inet6 proto ipv6-icmp all icmp6-type neighbradv keep state
                      pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type echorep keep state
                      pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routersol keep state
                      pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routeradv keep state
                      pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbrsol keep state
                      pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbradv keep state
                      pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type echorep keep state
                      pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routersol keep state
                      pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routeradv keep state
                      pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbrsol keep state
                      pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbradv keep state
                      pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type echoreq keep state
                      pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routersol keep state
                      pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routeradv keep state
                      pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbrsol keep state
                      pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbradv keep state
                      pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type echoreq keep state
                      pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type routersol keep state
                      pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type routeradv keep state
                      pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type neighbrsol keep state
                      pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type neighbradv keep state
                      pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type echoreq keep state
                      pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routersol keep state
                      pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routeradv keep state
                      pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbrsol keep state
                      pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbradv keep state
                      pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type echoreq keep state
                      pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type routersol keep state
                      pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type routeradv keep state
                      pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type neighbrsol keep state
                      pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type neighbradv keep state
                      ...
                      

                      That makes much of this discussion moot. It looks like fSense defaults to allowing (with various restrictions):

                      Packet Too Big
                      Destination Unreachable
                      Echo Reply
                      Echo Request
                      Neighbor Advertisement
                      Neighbor Solicitation
                      Router Advertisement
                      Router Solicitation

                      Oddly, of the Neighbor Discovery subset, it doesn't default to allowing Redirect. I wonder why? Of course, if it defaults to allowing those ICMPv6 subtypes into the system, why not those other "must pass" subtypes:

                      Parameter Problem (invalid IP header)
                      Time Exceeded?

                      SG-4860, pfSense 2.4.5-RELEASE-p1 (amd64)

                      1 Reply Last reply Reply Quote 0
                      • lohphatL
                        lohphat @johnpoz
                        last edited by May 9, 2020, 2:04 PM

                        @johnpoz Sorry for bumping this but is there a way to see "hidden" rules? The ICMPv6 "hidden" doesn't seem to allow echo reply so when it's said that pfSense has automatic rules for things to work, but things like echo doesn't work. This ambiguity is a source of some frustration.

                        SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                        1 Reply Last reply Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz May 9, 2020, 2:16 PM May 9, 2020, 2:12 PM

                          @lohphat said in 2.4.4 ICMPv6 Firewall Rules?:

                          there a way to see "hidden" rules?

                          https://docs.netgate.com/pfsense/en/latest/firewall/viewing-the-full-pf-ruleset.html

                          [2.4.5-RELEASE][admin@sg4860.local.lan]/root: pfctl -sr | grep ipv6
                          pass quick inet6 proto ipv6-icmp all icmp6-type unreach keep state
                          pass quick inet6 proto ipv6-icmp all icmp6-type toobig keep state
                          pass quick inet6 proto ipv6-icmp all icmp6-type neighbrsol keep state
                          pass quick inet6 proto ipv6-icmp all icmp6-type neighbradv keep state
                          

                          Echo reply is not a requirement for ipv6 to function. Other than at the link-local layer its not allowed automatic

                          pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type echorep keep state
                          

                          There are many more, just touching on the highlights..

                          Out of the box it doesn't allow ping to wan on ipv4 either, etc.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          lohphatL 2 Replies Last reply May 9, 2020, 5:18 PM Reply Quote 0
                          • lohphatL
                            lohphat @johnpoz
                            last edited by May 9, 2020, 5:18 PM

                            @johnpoz Thank you! Just what I was looking for.

                            When it comes to troubleshooting, knowing the actual rules vs implied is important.

                            There are gray areas when it comes to implied functionality which could be handled better. e.g. if IPv6 is enabled then due to the inherent need to support multicast groups (e.g. in lieu of ARP) it's not obvious how much of multicast functionality is implied. Is all FE80::/10 traffic allowed? Is IGMPv6 automatically implied (or needed), etc.

                            It would be nice to have an intro section covering just what is actually in play when VPN, IPv6, et al are enabled for each.

                            SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                            1 Reply Last reply Reply Quote 0
                            • lohphatL
                              lohphat @johnpoz
                              last edited by May 15, 2020, 10:45 PM

                              @johnpoz Here's an interesting find implying that pfSense still isn't multicast complete for either IPv4 or IPv6, in this case not supporting multicast membership management protocols.

                              https://redmine.pfsense.org/issues/6228

                              SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by May 16, 2020, 8:34 AM

                                The way I read that since set to OS, is that freebsd doesn't support it as of yet. So not really a "pfsense" thing that could be fixed.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                lohphatL 1 Reply Last reply May 16, 2020, 12:01 PM Reply Quote 0
                                • lohphatL
                                  lohphat @johnpoz
                                  last edited by May 16, 2020, 12:01 PM

                                  @johnpoz Agreed. I'm a bit surprised as FreeBSD is the basis for router code.

                                  But it does expose the lack of clarity of what functionality is or is not available. If a product claims to support IPv6 but is missing part of the protocol suite that needs to be documented somewhere instead of needing to hunt it down across several domains of dependency (OS, pfSense, OEM, etc.). Having a section listing known limitations, e.g. incomplete protocol suite/RFC implementation would REALLY help.

                                  SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by May 16, 2020, 3:08 PM

                                    I think your confused about multicast.. Routers don't need to do shit with that.. multicast is suppose to be on the L2...

                                    Membership management for multicast is not really something a router has to do or support.. Do that on your switch! ;) Ie your L2 device..

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                    lohphatL JKnottJ 2 Replies Last reply May 16, 2020, 3:12 PM Reply Quote 0
                                    • lohphatL
                                      lohphat @johnpoz
                                      last edited by May 16, 2020, 3:12 PM

                                      @johnpoz Not with IPTV. The multicast streams must pass the firewall. Also, if you have multicast inside the firewall they need to traverse VLANS. Where are the VLANS terminated? pfSense.

                                      Routers, and thus the reason IGMP proxy exists as a package, must be coordinated by all devices, especially routers, not just switches, when different segments must be traversed.

                                      SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by May 16, 2020, 3:14 PM

                                        That is why IPTV providers gives you their own shit ;)

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                        lohphatL 1 Reply Last reply May 16, 2020, 3:18 PM Reply Quote 0
                                        • lohphatL
                                          lohphat @johnpoz
                                          last edited by May 16, 2020, 3:18 PM

                                          @johnpoz Well even without IPTV, I've led multicast video deployments on internal enterprise networks, and as stated, traffic must traverse vlans and routers too. pfSense is a critical router if VLANS are terminated there.

                                          IPv4 made us complacent about multicast, it was easy to ignore, but with IPv6 it's an integral part of the protocol stack and piecemeal protocol stack implementations are not helping. We need to up our game.

                                          All I'm asking is for a call-out in the docs of where the known holes are instead of having to find them on our own.

                                          /end rant ;-)

                                          SG-3100 24.11-RELEASE (arm) | Avahi (2.2_6) | ntopng (5.6.0_1) | openvpn-client-export (1.9.5) | pfBlockerNG-devel (3.2.1_20) | System_Patches (2.2.20_1)

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.