• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

HE.net GIF requires disabling Outer Source Filtering?

Scheduled Pinned Locked Moved IPv6
4 Posts 3 Posters 465 Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    Shirakaba 0
    last edited by Feb 27, 2023, 8:20 PM

    I'm currently on 23.01, but I have had some trouble with my IPv6 connection through HE.net Tunnelbroker ever since I guess 22.05. I'm not sure when it stopped working. I took some time troubleshooting it today and found that I could get it working again by ticking the setting "Outer Source Filtering" to disable the filtering on my GIF interface.

    When I was watching my WAN interface with tcpdump I could clearly see both the ICMP requests and replies, but on the GIF-interface, I could only see the outgoing requests. It doesn't sound good from a security perspective to disable the filtering and I haven't seen this setting mentioned in any tutorials or manuals for setting up the IPv6 tunnel. Is there something strange going on with my setup that requires this setting to be set?

    S J 2 Replies Last reply Feb 27, 2023, 9:27 PM Reply Quote 0
    • S
      SteveITS Galactic Empire @Shirakaba 0
      last edited by Feb 27, 2023, 9:27 PM

      @shirakaba-0 I don't see that checked on a tunnel of ours. Given the description, "When disabled, martian and inbound filtering is not performed which allows asymmetric routing of the outer traffic," could you be experiencing asymmetric routing?

      Also, see the HE doc at https://docs.netgate.com/pfsense/en/latest/recipes/ipv6-tunnel-broker.html

      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
      Upvote 👍 helpful posts!

      1 Reply Last reply Reply Quote 0
      • J
        johnpoz LAYER 8 Global Moderator @Shirakaba 0
        last edited by Feb 27, 2023, 10:08 PM

        @shirakaba-0 said in HE.net GIF requires disabling Outer Source Filtering?:

        ticking the setting "Outer Source Filtering" to disable the filtering on my GIF interface.

        I don't have this checked on my HE tunnel - and I have seen no problems going back a long time... I have had a HE tunnel setup with pfsense like forever.. I mean going back like 12 years, I just looked when I got my sage cert from HE, and it was back in 2011.. That would of been I think the weekend after I setup first tunnel to them from pfsense.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • S
          Shirakaba 0
          last edited by Feb 28, 2023, 3:01 PM

          Appears the problem was related to a secondary WAN interface we have configured in the firewall. As soon as that WAN interface was disabled, the GIF tunnel would work without the filtering disabled. When the secondary WAN interface was enabled again, the tunnel still worked, so probably some messed up routing.

          1 Reply Last reply Reply Quote 0
          1 out of 4
          • First post
            1/4
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
            This community forum collects and processes your personal information.
            consent.not_received