Disable IPV6 completely

johnpoz

Not logging stuff you have control over is not best solution.. Since its still actually there - your just not looking at it..

For example there is one thing if your tired of looking at the noise from the public internet of the bots hitting you on port 3389, and you just don't want to see it in your logs any more.. There is really nothing you can do about that sort of noise.

But if what your seeing is your devices asking for dhcpv6, and your firewall is logging it.. What is better for your network.. Just turn off the logging and ignore it, or just set the device that keeps asking for dhcpv6 to not ask for dhcpv6 since your not running IPv6 on this network..

Details of what exactly is being logged will help us determine best way to accomplish what @erbalo wants.

Maybe what is flooding his logs with noise is some iot device that he has zero control over it putting ipv6 noise on the wire.. The better solution for just ignoring this by not logging it, might be to isolate that iot device and any of its brothers to their own L2, so that now that noise isn't on his normal devices network/wifi.. Or maybe he can block the noise at the switch port before this noise enters the network - vs just not logging it..

erbalo

Here are some details about my configs and logs. The problem is here because too much logs i can't see another logs over and can't solve another problems becuase too much logs of IPV6..

Some of logs:

Can you please also verify me to my system logs settings?

PFblocker also blocked ipv6 country:

IPV6 settings of Pfsense:

johnpoz

Not sure the point of hiding link local IPs.. But that traffic is multicast dns and LLMNR (another local name resolution protocol)..

I would suggest you turn that off at the machine.. the LLMNR would scream some windows machine to me.. Turn it off there.

But if you don't want that nonsense logged, then create a rule that doesn't log it.. I would create a rule with dest say ff00::/8 and not log it..

erbalo

@johnpoz said in Disable IPV6 completely:

ff00::/8

Ok just by me the destination IPV6 address is everytime different.

When you add this rule, did you then pass this rule also? Is that not strange to do that? By me on the logs i see that this address is blocked.

johnpoz

Doesn't matter if you pass it or block it... pfsense isn't going to do anything with it anyway!

The dest ff00:://8 would include all of that dest traffic!

Again the best solution is turn off the noise at the source!!

Gertjan

@johnpoz said in Disable IPV6 completely:

Again the best solution is turn off the noise at the source!!

Another one might be : locate and obliterate that device that likes so much ports "5353 and 5355 ".

erbalo

@johnpoz When i want to add this rule it says destination ip is not correct, how did you add that to the rule. I am planning to add this rule on floating and then as block.

NogBadTheBad

Post a screenshot.

You can drag a screenshot into the reply window.

johnpoz

As network

make sure you tick the quick checkbox! How many interfaces do you have? Its normally a GOOD idea to put the rules directly on the interface... So you don't forget about them when looking at your rules.

There would be 1 thing if you had 100 interfaces... But when you have a handful, just put the rules directly on the interface!!

But if you don't want to see any ipv6 noise - prob just make the dest ANY Ipv6 vs the specific multicast destination

erbalo

This post is deleted!

johnpoz

Because that is NOT single addres ff00::/8 is a NETWORK!

And again its not going to do you any good on floating if you don't tick the quick option!

Why would you be picking the WAN interface? Are you seeing ipv6 noise on your wan? That you don't have an IPv6 address on? What sort of noise is that? Post a screenshot of such noise please.

And yet again I am going to mention this - you would be better off turning it off at the source of the NOISE!! Disable IPv6 on your windows machines for example... Which I would guess would of been the source of that LLMNR traffic.. Windows loves to have that shit on by default..

erbalo

With this settings the logs are not go on and still coming on.

I have searched the source in NTOPng but i can't found which device that is, i don't get a DNS name.

I will also try to put the rule on the interfaces.

johnpoz

And is what your seeing in the logs to the ff00:: network?

What you posted before was.. Your saying your still seeing that? What other rules do you have on floating? So we can see the order.

Since you don't want to see IPv6 in your logs, just set the dest to ANY.. vs just multicast..

ff02::fb in your log for example is the ipv6 link-local dest multicast address

FF02:0:0:0:0:0:0:FB mDNSv6

So if your still seeing it logged, you have something other than the default rule logging it. Possible the Block ALL IPv6 rule... What is the description on your log?

Turn off the block all IPv6 setting... It's pretty pointless if you don't have any ipv6 setup on your interfaces in the first place, or don't allow IPv6 inf your rules anyway.

erbalo

just here are some of logs:

Gertjan

When you want to block all incoming IPv6 traffic :

Note : unchecking this option == blocking UIPv6 activates rule "1000000003" =

block in log quick inet6 all tracker 1000000003 label "Block all IPv6"

and you have this option set :

then yeah, your Firewall log will get hail stormed by these '100000003' lines.
After all, all your devices on your LAN's are still going to try to use IPv6.

So, you get exactly what you are asking ...

erbalo

@Gertjan

Oh just;

Unceck the Allow IPV6 (it was by me allready unchecked)
And then using the Command shell run: block in log quick inet6 all tracker 1000000003 label "Block all IPv6
Go to the Rule 1000000003 and uncheck Log packets

Is that correct?

johnpoz

Your not suppose to run anything in the shell.

Your block all IPv6 rule is evaluated before your no log rule.. So stop blocking all IPv6.. and your logs will clear up..

With your no log rule..

Blocking all IPv6 is pointless if your not allowing it in the first place.. all interfaces have default deny. Unchecking that box is just going to spam your log with all IPv6 traffic that is blocked.

Also ZERO point in hiding link-local address space.. But stops us from seeing if that is 1 device or multiple devices. Again the best advice I can give you is turn IPv6 off at the devices themselves if you don't want noise on your network... Your not using IPv6.. So every packet put on the wire is just noise, be you log it or not..

viktor_g

also check this: https://redmine.pfsense.org/issues/9837

Gertjan

@erbalo said in Disable IPV6 completely:

Is that correct?

For one third.

Uncheck - see my image above.
Doing so, this will place a firewall rule '100000003' that block all IPV6 traffioc on all interface. This is what Unchecking "Allow IPV6" does, not more, not less.
To see the firewall rule : Take a look at /tmp/rules.debug

I do not understand what you mean with 2. There is nothing to execute by you.

Even less.

Again.

Uncheck this one :

and hit the bleu Save button at the bottom.

Problem solved.

edit : solved .... is relative.
IPv4 is still fading out - IPV6 is the future.
Accepting it, learning it is not some kind of luxury.
If you are selling hair dryer all your live, you might need any IPv6 knowledge.
If you maintain and administer Firewalls ... there is no choice.

JKnott

@erbalo

If you have IPv6 service, why would you want to block it? What sort of log entries are you getting? Where are they from?