Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    HE.net GIF requires disabling Outer Source Filtering?

    IPv6
    3
    4
    72
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      Shirakaba 0 last edited by

      I'm currently on 23.01, but I have had some trouble with my IPv6 connection through HE.net Tunnelbroker ever since I guess 22.05. I'm not sure when it stopped working. I took some time troubleshooting it today and found that I could get it working again by ticking the setting "Outer Source Filtering" to disable the filtering on my GIF interface.

      When I was watching my WAN interface with tcpdump I could clearly see both the ICMP requests and replies, but on the GIF-interface, I could only see the outgoing requests. It doesn't sound good from a security perspective to disable the filtering and I haven't seen this setting mentioned in any tutorials or manuals for setting up the IPv6 tunnel. Is there something strange going on with my setup that requires this setting to be set?

      S johnpoz 2 Replies Last reply Reply Quote 0
      • S
        SteveITS @Shirakaba 0 last edited by

        @shirakaba-0 I don't see that checked on a tunnel of ours. Given the description, "When disabled, martian and inbound filtering is not performed which allows asymmetric routing of the outer traffic," could you be experiencing asymmetric routing?

        Also, see the HE doc at https://docs.netgate.com/pfsense/en/latest/recipes/ipv6-tunnel-broker.html

        Steve

        Only install packages for your version, or risk breaking it. If yours is older, select it in System/Update/Update Settings.
        When upgrading, let it finish; do not reboot early. Allow 10-15 minutes, or more depending on packages and device speed.

        1 Reply Last reply Reply Quote 0
        • johnpoz
          johnpoz LAYER 8 Global Moderator @Shirakaba 0 last edited by

          @shirakaba-0 said in HE.net GIF requires disabling Outer Source Filtering?:

          ticking the setting "Outer Source Filtering" to disable the filtering on my GIF interface.

          I don't have this checked on my HE tunnel - and I have seen no problems going back a long time... I have had a HE tunnel setup with pfsense like forever.. I mean going back like 12 years, I just looked when I got my sage cert from HE, and it was back in 2011.. That would of been I think the weekend after I setup first tunnel to them from pfsense.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 23.01 | Lab VMs CE 2.6, 2.7

          1 Reply Last reply Reply Quote 0
          • S
            Shirakaba 0 last edited by

            Appears the problem was related to a secondary WAN interface we have configured in the firewall. As soon as that WAN interface was disabled, the GIF tunnel would work without the filtering disabled. When the secondary WAN interface was enabled again, the tunnel still worked, so probably some messed up routing.

            1 Reply Last reply Reply Quote 0
            • First post
              Last post