HE.net GIF requires disabling Outer Source Filtering?
-
I'm currently on 23.01, but I have had some trouble with my IPv6 connection through HE.net Tunnelbroker ever since I guess 22.05. I'm not sure when it stopped working. I took some time troubleshooting it today and found that I could get it working again by ticking the setting "Outer Source Filtering" to disable the filtering on my GIF interface.
When I was watching my WAN interface with tcpdump I could clearly see both the ICMP requests and replies, but on the GIF-interface, I could only see the outgoing requests. It doesn't sound good from a security perspective to disable the filtering and I haven't seen this setting mentioned in any tutorials or manuals for setting up the IPv6 tunnel. Is there something strange going on with my setup that requires this setting to be set?
-
@shirakaba-0 I don't see that checked on a tunnel of ours. Given the description, "When disabled, martian and inbound filtering is not performed which allows asymmetric routing of the outer traffic," could you be experiencing asymmetric routing?
Also, see the HE doc at https://docs.netgate.com/pfsense/en/latest/recipes/ipv6-tunnel-broker.html
-
@shirakaba-0 said in HE.net GIF requires disabling Outer Source Filtering?:
ticking the setting "Outer Source Filtering" to disable the filtering on my GIF interface.
I don't have this checked on my HE tunnel - and I have seen no problems going back a long time... I have had a HE tunnel setup with pfsense like forever.. I mean going back like 12 years, I just looked when I got my sage cert from HE, and it was back in 2011.. That would of been I think the weekend after I setup first tunnel to them from pfsense.
-
Appears the problem was related to a secondary WAN interface we have configured in the firewall. As soon as that WAN interface was disabled, the GIF tunnel would work without the filtering disabled. When the secondary WAN interface was enabled again, the tunnel still worked, so probably some messed up routing.
