pfSense 25.11RC does not like IPv6 turned off?

gniting

Upgraded to 25.11RC and post install reboot, no connectivity for lan devices. The pfSense box itself (a vm on proxmox) was able to talk to the Internet properly, but no luck for devices on the LAN. They could ping each other, but no traffic was coming or going to the Internet.

Error msg that I got was:
There were error(s) loading the rules: pfctl: DIOCADDRULE: Protocol family not supported - The line in question reads [0]: @ 2025-11-21 08:59:10

Digging around I found out that this is cause I had "Allow IPv6" turned off under Settings → Advance → Networking. I don't use/need IPv6 on my LAN. Everything was running peachy prior to the update.

Apparently, in newer versions of FreeBSD, the pf module becomes very strict. If the configuration generates a single line of logic referencing inet6 (IPv6), but the kernel has been told "IPv6 is disabled," the generic pfctl loader crashes with DIOCADDRULE: Protocol family not supported. This crash then causes the entire ruleset to fail, defaulting the firewall to a "Block All" state for safety.

Ouch.

So now it looks like I need to leave IPv6 on?

Bob.Dig

@gniting No problem here, I just tested this.

kprovost

@gniting Do you by any chance have nat64 rules?

gniting

@kprovost said in pfSense 25.11RC does not like IPv6 turned off?:

@gniting Do you by any chance have nat64 rules?

Nope, I do not.

gniting

@Bob.Dig said in pfSense 25.11RC does not like IPv6 turned off?:

@gniting No problem here, I just tested this.

So you were able to upgrade to 25.11RC while having "allow IPv6" off?

stephenw10

Hmm, can't replicate that so far.

Unsetting that doesn't disable IPv6 in the kernel. It just removes the default IPv6 rules that pass traffic.

Can you see exactly what rule is generating that?

gniting

@stephenw10 said in pfSense 25.11RC does not like IPv6 turned off?:

Hmm, can't replicate that so far.

Unsetting that doesn't disable IPv6 in the kernel. It just removes the default IPv6 rules that pass traffic.

Can you see exactly what rule is generating that?

How do I go about that? Also, I am assuming you are recommending I turn off "Allow IPv6" and then try to hunt down the rule?

stephenw10

Yes, if you can replicate it in 25.11RC by simply disabling allow IPv6. Look at the system logs for errors. Try running Status > Filter Reload and see where it errors.

I still can't generate that error here even on systems with NAT64. So it seems likely you have some other unusual rule.

Are you able to upload your ruleset to us for testing? If so please upload the /tmp/rules.debug file here: https://nc.netgate.com/nextcloud/s/cFFWNHnLdm3rXtQ