How to create IPv6 firewall rules?
-
And for privacy reasons, I even like dynamic IPs (and prefixes) in general.
-
Oh yes, that's definitely a good point!
-
That conflicts with RFC 8415, which includes:
"If the client wishes to obtain a distinctly new address or prefix and
deprecate the existing one, the client sends a Release message to the
server for the IAs using the original IAID. The client then creates
a new IAID, to be used in future messages to obtain leases for the
new IA."That seems to say that a device is supposed to specifically release the association and the setting simply tells pfsense to not release the address, etc..
What's the point of having a permanent identifier, if the ISP ignores it?
-
@Bob-Dig said in How to create IPv6 firewall rules?:
And for privacy reasons, I even like dynamic IPs (and prefixes) in general.
Well, if you turn off that setting, then pfSense gets amnesia.
-
@JKnott Implications only work in one direction. This only describes what to do when the client from its side wants a distinctly new address/prefix so when the server behaves like the one of your ISP. This says nothing about other situations where the address/prefix may change as well.
The IAID is the ID of "a construct through which a server and a client can identify, group, and manage a set of related IPv6 addresses or delegated prefixes.", so to distinguish different sets of DHCP parameters, e.g for different interfaces "A client must associate at least one distinct IA with each of its network interfaces for which it is to request the assignment of IPv6 addresses from a DHCP server. The client uses the IAs assigned to an interface to obtain configuration information from a server for that interface. Each such IA must be associated with exactly one interface.".
The point of having a permanent identifier is that the DHCP server can use it to distinguish the IAs even if the client restarts (e.g. not to switch the IP addresses of the interfaces), but it doesn't imply that it isn't allowed to changes prefixes or any other information within the IA if it or its administrator likes.
For "Assignment of Prefixes for IA_PD" what we are talking here about, https://tools.ietf.org/html/rfc8415#section-13.3 is relevant, which basically says that's not covered at all by RFC8415 ("The mechanism through which the server selects prefix(es) for delegation is not specified in this document.") so basically "do as you like", as examples "static assignment based on subscription to an ISP, dynamic assignment from a pool of available prefixes" and as one example it refers to https://tools.ietf.org/html/rfc3162 (RADIUS, which is probably often used on ISP side for logins) and it gives even the RADIUS server much freedom, e.g. it says "This Attribute indicates an IPv6 prefix (and corresponding route) to be configured for the user. It MAY be used in Access-Accept packets, and can appear multiple times. It MAY be used in an Access-Request packet as a hint by the NAS to the server that it would prefer these prefix(es), but the server is not required to honor the hint."
-
We got into this discussion because @zjgn said:
"Thanks for your input. Those bug reports confirm that IPv6 in pfSense isn't really usable as of now (at least on domestic connections), which is a great shame.To which I replied:
If the ISP is not respecting the Do not allow PD/Address release setting, how is that pfSense's fault?If that setting works with some ISPs, but not others, is the problem with pfSense, as @zjgn implies? Or the ISP, as I suggest? It seems to me this wouldn't affect only pfSense, but any firewall/router that uses DHCPv6-PD, so @zjgn shouldn't be blaming pfSense for something beyond it's control.
-
@JKnott The "Do not allow PD/Address" is not even relevant in this descussion. When you are getting your IP prefix via DHCP, that means you get it dynamically. If you copy this dynamic prefix into a static configuration, you are doing it wrong. Period. If you have a dynamic prefix, all settings you want to use have to support that. If you have a static prefix, configure it statically and do not get it via DHCP!
Settings in pfSense that do not support dynamic prefixes (some even do already, like e.g. the IP configurations for LANs that have the "track interface" option) are just not usable in this scenario. You may call it a bug or you might call it just missing features, but it's pfSense's task to support dynamic prefixes ideally for all settings. It can be done and as it was mentioned before, they are working on it, it's just work that has to be done, and as pfSense has many features compared to other routers (e.g. not many routers support Multi-WAN at all), it's much work. Therefore I cannot follow your conclusion "It seems to me this wouldn't affect only pfSense, but any firewall/router that uses DHCPv6-PD, so @zjgn shouldn't be blaming pfSense for something beyond it's control.".
"Do not allow PD/Address" is just a workround that works in some situations, but it is not a static prefix/address. Period.
-
@HG said in How to create IPv6 firewall rules?:
The "Do not allow PD/Address" is not even relevant in this descussion. When you are getting your IP prefix via DHCP, that means you get it dynamically. If you copy this dynamic prefix into a static configuration, you are doing it wrong. Period. If you have a dynamic prefix, all settings you want to use have to support that. If you have a static prefix, configure it statically and do not get it via DHCP!
Who's copying an address into a static config? I am using DHCPv6-PD. Always have. When I use that setting, my prefix does not change. Is that not the purpose of it? According to my understanding, if that setting is not enabled, pfSense will tell my ISP to release my prefix and that's exactly what was happening before it was available. A loose comparison would be DHCPv4 static mappings. DHCP is still being used, but the address doesn't change. Even without that, DHCP addresses don't normally change, unless the lease has expired and the address is no longer available. With my ISP, my IPv4 address is virtually static. It only changes when I change hardware. Other than that, there was one occasion several years ago, when they renumbered the network, which forced an address change on everyone. By comparison, without that setting, my prefix would change if I did nothing more than disconnect/reconnect the WAN cable, which made it even worse than plain DHCP on IPv4.
-
You both have valid reasons.
I for myself think that the first thing that should be made possible in pfSense is the integration of NPt for dynamic prefixes, should be rather easy to implement by now.What I can't tell is, if it would solve all the problems with the lack of fine control over IPv6 we now have over IPv4...
Privacy extensions maybe could be implemented at the router level and not the host level? That potentially would help for example.
Or better, the firewall just knows all the hosts with all their addresses, however this is possible.
This fine control is probably the reason why we are using (and loving) pfSense in the first place. -
@Bob-Dig said in How to create IPv6 firewall rules?:
Privacy extensions maybe could be implemented at the router level and not the host level?
????
Privacy extensions are host addresses. They have to be on the host.
-
@JKnott said in How to create IPv6 firewall rules?:
@Bob-Dig said in How to create IPv6 firewall rules?:
Privacy extensions maybe could be implemented at the router level and not the host level?
????
Privacy extensions are host addresses. They have to be on the host.
See it in the context of the problems we got now in pfSense. But first you have to see the problems.
-
I believe the relevant part of the original question is:
"How to create firewall rules if I don't know the address of the hosts?"
@zjgn was trying to solve a problem that doesn't exist, due to his unfamiliarity with IPv6 and privacy addresses. I pointed out that he only had to worry about the consistent address, which is often based on the MAC address, but could also be a random number. This is the address that's used for incoming connections and for which the rules have to be written. The privacy addresses are normally used for outgoing connections, which are blocked for incoming connections by default. As mentioned, if privacy addresses are a problem, they can be disabled. Then you mentioned using NPt, for some reason, and the discussion moved into how that didn't work because the prefix was changing, etc.. Does that sum it up? The next question is why the prefix is changing. I maintain it shouldn't, when Do not allow PD/Address release is set, though I know some ISPs will change the prefix anyway. This reminds me of when some ISPs would frequently change the IPv4 address, when there was no need to. In short, they were just being nasty.
-
@JKnott said in How to create IPv6 firewall rules?:
@Bob-Dig
"How to create firewall rules if I don't know the address of the hosts?"No, the problem we are facing is that pfSense doesn't know all the addresses of a host and therefore we can't create granular firewall rules, especially for outgoing connections, like we could for IPv4.
-
@Bob-Dig said in How to create IPv6 firewall rules?:
No, the problem we are facing is that pfSense doesn't know all the addresses of a host and therefore we can't create granular firewall rules, especially for outgoing connections, like we could for IPv4.
Well, given that privacy addresses come and go by design, there's no way around that, short of filtering on the MAC address, which pfSense doesn't do.
-
@JKnott said in How to create IPv6 firewall rules?:
Well, given that privacy addresses come and go by design, there's no way around that, short of filtering on the MAC address, which pfSense doesn't do.
Then I hope pfSense will get there.
-
Perhaps DDNS and use that hostname in rules? https://duckduckgo.com/?t=ffab&q=ddns+for+ipv6&ia=web
-
@teamits said in How to create IPv6 firewall rules?:
Perhaps DDNS and use that hostname in rules? https://duckduckgo.com/?t=ffab&q=ddns+for+ipv6&ia=web
Perhaps read the thread before posting crap.
-
Well the initial and one of the important questions in this thread was to create something like this, so e.g. an alias for all internal addresses.
@zjgn said in How to create IPv6 firewall rules?:
internal_nets = 10.0.0.0/8, 192.168.0.0/16
To solve this specific problem, you do not need to know all the addresses or whatever. You only need the possibility to use the dynamic prefix in firewall aliases, e.g. if you have a /56 prefix:
internal_nets = $WAN_IPV6_PREFIX/56
or even
internal_nets = $WAN_IPV6_PREFIX/$WAN_IPV6_PREFIX_SIZE
where pfSense automatically substitutes $WAN_IPV6_PREFIX with the prefix it got via DHCP on that interface. Unfortunately not possible right now, but this could be a option from UI perspective how firewall aliases could be extended to work with dynamic prefixes. Could also be a drop-down in the web interface or whatever.
Another solution, if https://redmine.pfsense.org/issues/4881 is implemented, you can configure static ULAs for the internal communication and easily use these addresses in firewall rules because they are really really static, not somewhat sometimes temporary pseudo-static as with "Do not allow PD/Address release".
This only thing that's really hard from conceptual perspective (on IP level), but that has nothing to do with DHCP at all and is also not solved by "Do not allow PD/Address release", is if you want to block individual temporary privacy IPv6 addresses. But everything that is because of the prefix changing could be solved by something like a $WAN_IPV6_PREFIX placeholder (or drop-downs in the UI or whatever). Don't get me wrong, I know that it's not easy to integrate it everywhere and I understand that it takes time, but it's the clean solution that's needed to be able to use the full functionality of pfSense with delegated prefixes via DHCPv6.
-
@HG said in How to create IPv6 firewall rules?:
not to use IPv6 for internal communication for now (only for Internet communication
These days, a bunch of Microsoft (Apple also) devices will use IPv6 for the local network 'Neighbourhood', using auto assigned address. pfSense couldn't even stop them doing so.
So "you" are using it.
Exception : you step down form the default network settings : de activate IPv6 on every LAN type device.
But why would you ? -
@Gertjan said in How to create IPv6 firewall rules?:
pfSense couldn't even stop them doing so.
Not sure how you figure that, via their cell connection.. Yeah your right they are most likely using IPv6..
If they want to use IPv6 for local communication between each other, sure again you have no control over what devices do on the L2 network amongst themselves.
But between vlans, or to the internet via pfsense - nope not using IPv6 unless you allow it.
But if your using a switch with the right feature set, sure you can block IPv6 between L2 devices.
What is the ultimate goal here - block unwanted ipv6.. That is very simple to do, just do not allow it between vlans all together. What is more difficult is blocking or allowing the source IP of the traffic to dest.. Since sure the client could use a temp address as its source. That would have to be disabled on the client.
This is why it has always been practice to block/allow via prefix be your ipv6 prefix or your ipv4 network..
The prefix used on any specific network on pfsense even via tracking and delegation that changes will still be known as the Vlan net, you can use that in your rules.. So even if the prefix changes on the interface, the "net" alias will be the assigned prefix to that interface. So if I want to block ipv6 traffic between lan and vlan, can just use those as the source and dest IPs
Here's the thing, if you are not at a place where you feel you can control IPv6 traffic how you desire, then turn it OFF.. There is zero requirement for IPv6 be it locally or globally. At that time.. If you can not control it like you want, then sure just turn it off. Your still going to be able to get to any website/service you desire.. Name one actual mainstream service that is not still reachable via IPv4.. When you can not get to facebook or google via IPv4 - then sure IPv6 will be required - but until you can name a specific service that requires you to have IPv6, if you can not control it how you want - then just turn it off.
There are millions of users, if not billions that do not even have IPv6 today.. So clearly its not a "requirement" that you have it.. Or use it - unless you want to.