Firewall rules for IPV6 track interface.
-
@bassopt So this looks ok.
I did a quick test from my vps and everything is closed here. -
Thanks! No idea why this happening…
-
@bob-dig btw are you using pfsense+ or community? I’ll try to reinstall pfsense tomorrow and restore Di figs from a backup and see if anything changes.
-
Any other input in this? I’ve reinstalled pfsense+ and pfsense community edition and problem still exists.
-
@bassopt said in Firewall rules for IPV6 track interface.:
ssh into the ipv6 address assigned to one of my docker VMs. And voilá… instant access
Are you connecting from another PC on your LAN? (which wouldn't go through the router...)
In theory you can add a rule on WAN to block all IPv6 but the default block rule should be blocking everything inbound.
-
@steveits no. I’m accessing from a vps outside my lan. That’s why something doesn’t add up. I know I could add a firewall rule if I wanted to ssh into vm but I don’t. Still all my lan machines are completely exposed when the get a global address from pfsense with no passing rules whatsoever.
-
Found the issue.
PFBlockerNG .... uninstalled it and problem is solved. No clue what it might be doing but whatever !!!
-
@bassopt hey there, good to know you solved it.
Just out of interest, did you use pfblockerng at all, meaning, have you configured something regarding ip whitelists or geoIP?
Some existing floating rules might then have been the issue...
Just having pfblockerng installed without any settings active and aliase or rules created shouldn't cause that...
Or Am I wrong assuming that (*looking at the more experienced people here)
:) -
@the-other pfBlocker can set up allow or block rules, or aliases, or DNSBL. By itself, without any configuration, it basically does nothing. Any rules it creates would normally be on the LAN and/or WAN rule pages.
-
@steveits
Hey there and thanks for your reply.
That is what I thought.
So, there must have been some rule responsible for this issue. Since the Screenshots of wan and lan did not show any such rule, I figured there must have been other rules...
Just uninstalling pfblockerng solving the problem seems strange otherwise.
Just trying to understand this issue.