The following pf.conf (FreeBSD 10.3) appears to be blocking all IPv6 traffic and I can't work out why.

tcp_inbound = "{ ssh, domain, http, https }"
tcp_outbound = "{ domain, http, https, imaps, smtps }"

udp_services = "{ domain, ntp }"

block all
pass proto udp to any port $udp_services keep state
pass out proto tcp to any port $tcp_outbound keep state
pass in proto tcp to any port $tcp_inbound keep state

# from https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist/
table <github> {, 2620:112:3000::/44 }
pass out proto tcp to <github> port { ssh } keep state

pass proto icmp from any to any

How do I allow IPv6 traffic on the same services I allow for IPv4? I added explicit inet6 versions of each rule and it didn't seem to help. If I disable pf then the IPv6 traffic gets through fine.


By enabling logging I managed to work out that this is because the ICMP6 router solicitation was being blocked. Adding

pass proto ipv6-icmp from any to any

to the end of the file fixed the problem.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.