3

I'm trying to filter out specific ICMPv6 packets and I tried looking at all the possible types options by using the following command:

ip6tables -p icmpv6 -h

This yields the following types (note the nested ones):

Valid ICMPv6 Types:
destination-unreachable
   no-route
   communication-prohibited
   address-unreachable
   port-unreachable
packet-too-big
time-exceeded (ttl-exceeded)
   ttl-zero-during-transit
   ttl-zero-during-reassembly
parameter-problem
   bad-header
   unknown-header-type
   unknown-option
echo-request (ping)
echo-reply (pong)
router-solicitation
router-advertisement
neighbour-solicitation (neighbor-solicitation)
neighbour-advertisement (neighbor-advertisement)
redirect

Can the nested types be specifically targeted?

Is this the correct syntax to, say, DROP outgoing no-route destination unreachable packets?

ip6tables -A OUTPUT -p icmpv6 --icmpv6-type destination-unreachable no-route -j DROP
1
  • That should work. And it will definitely break the Internet for you. Oct 1, 2018 at 16:12

1 Answer 1

2

Just match the no-route type directly:

ip6tables -A OUTPUT -p icmpv6 --icmpv6-type no-route -j DROP

If you wanted to drop all destination-unreachable types, you would use:

ip6tables -A OUTPUT -p icmpv6 --icmpv6-type destination-unreachable -j DROP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.