Firewall rules for IPV6 track interface.
-
@bob-dig said in Firewall rules for IPV6 track interface.:
So how do you came up with this, how have you checked this.
Because I have a vps running on vultr and decided to ssh into the ipv6 address assigned to one of my docker VMs. And voilá… instant access. If I do it to the (global) ipv4 address it’s blocked.
-
@bassopt So then show your WAN rules, you have to open ports for IPv6 too, it is not open by default.
-
I have zero rules on the wan interface assigned for ipv6 only ipv4.
I just configured ipv6 today.It’s as if the track interface from wan to lan, ignores completely the wan rules and only uses the lan ones. That’s why everything is exposed.
Note that my wan interface doesn’t even has have an ipv6 address ( that’s how my isp works apparently ) just a ff80: link local address ..
-
@bassopt said in Firewall rules for IPV6 track interface.:
That’s why everything is exposed.
No, exposed is only your missing knowledge about this. But without screens it is hard to say what is wrong with your setup.
-
-
@bassopt So this looks ok.
I did a quick test from my vps and everything is closed here. -
Thanks! No idea why this happening…
-
@bob-dig btw are you using pfsense+ or community? I’ll try to reinstall pfsense tomorrow and restore Di figs from a backup and see if anything changes.
-
Any other input in this? I’ve reinstalled pfsense+ and pfsense community edition and problem still exists.
-
@bassopt said in Firewall rules for IPV6 track interface.:
ssh into the ipv6 address assigned to one of my docker VMs. And voilá… instant access
Are you connecting from another PC on your LAN? (which wouldn't go through the router...)
In theory you can add a rule on WAN to block all IPv6 but the default block rule should be blocking everything inbound.
-
@steveits no. I’m accessing from a vps outside my lan. That’s why something doesn’t add up. I know I could add a firewall rule if I wanted to ssh into vm but I don’t. Still all my lan machines are completely exposed when the get a global address from pfsense with no passing rules whatsoever.
-
Found the issue.
PFBlockerNG .... uninstalled it and problem is solved. No clue what it might be doing but whatever !!!
-
@bassopt hey there, good to know you solved it.
Just out of interest, did you use pfblockerng at all, meaning, have you configured something regarding ip whitelists or geoIP?
Some existing floating rules might then have been the issue...
Just having pfblockerng installed without any settings active and aliase or rules created shouldn't cause that...
Or Am I wrong assuming that (*looking at the more experienced people here)
:) -
@the-other pfBlocker can set up allow or block rules, or aliases, or DNSBL. By itself, without any configuration, it basically does nothing. Any rules it creates would normally be on the LAN and/or WAN rule pages.
-
@steveits
Hey there and thanks for your reply.
That is what I thought.
So, there must have been some rule responsible for this issue. Since the Screenshots of wan and lan did not show any such rule, I figured there must have been other rules...
Just uninstalling pfblockerng solving the problem seems strange otherwise.
Just trying to understand this issue.
)
