Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPv6 incoming on WAN wont log (6to4)

    Scheduled Pinned Locked Moved 2.3-RC Snapshot Feedback and Issues - ARCHIVED
    8 Posts 4 Posters 2.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • chpalmerC
      chpalmer
      last edited by

      all snaps last week or so. Not sure before as I didn't test.

      I have a 6to4 tunnel (provided by my ISP) on my WAN. I have rules to allow ICMP and set them to log.  If I log into a remote box and have it ping my WAN using IPv6 the remote box reports the pings as successful. But the traffic never shows up in my firewall logs. Did the same and pinged my server behind this box and those do not show up either.

      Traffic is also visible in the states.

      Normal?

      Triggering snowflakes one by one..
      Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

      1 Reply Last reply Reply Quote 0
      • C
        cmb
        last edited by

        Check which rule it's matching, 'pfctl -vvss' output with rule number matched to 'pfctl -vvsr'. The one you expect?

        1 Reply Last reply Reply Quote 0
        • A
          athurdent
          last edited by

          I can confirm this with my he.net tunnel. Packets from my ICMPv6 pass rule are not logged if I ping my local tunnel endpoint from external.
          Another thing I noticed, even if there are no rules at all and you enable "Log packets matched from the default block rules in the ruleset" the ping gets dropped and does not show up in the logs.

          1 Reply Last reply Reply Quote 0
          • A
            athurdent
            last edited by

            Rule looks OK and also gets hit if I ping:

            pass in log quick on gif0 reply-to (gif0 2001:*::1) inet6 proto ipv6-icmp all icmp6-type echoreq keep state label "USER_RULE: Log ICMPv6"
              [ Evaluations: 153       Packets: 142       Bytes: 7952        States: 1     ]
              [ Inserted: pid 68896 State Creations: 3     ]
            
            

            But nothing shows up in tcpdump -nvvvettti pflog0

            Seems to be related to ICMP only.
            When I try to telnet my v6 IP, that gets blocked and logged correctly.

            Edit: does not seem to be limited to 6to4 though. Just tested with another machine, the ICMPv6 log rule on a normal dual stack host does not work either.

            1 Reply Last reply Reply Quote 0
            • C
              cmb
              last edited by

              It logs, just doesn't end up showing in the GUI.
              https://redmine.pfsense.org/issues/5933

              1 Reply Last reply Reply Quote 0
              • C
                cmb
                last edited by

                Fixed.
                https://github.com/pfsense/pfsense/pull/2690

                1 Reply Last reply Reply Quote 0
                • A
                  athurdent
                  last edited by

                  Thanks cmb and NYOB, it works now.

                  1 Reply Last reply Reply Quote 0
                  • N
                    NOYB
                    last edited by

                    You're welcome.  I'm surprised this had never been reported before now.  It's the same code as in 2.2.x.  Been the same for quite some time.

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post
                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.