Re: openbsd 3.2, pf, and ipv6 tunnels

[Richard Welty <rwelty@averillpark.net>]

On Sun, 03 Aug 2003 13:38:51 +0200 "Asbjorn L. Johansen" <notsane@sveitt.org> wrote:
> Shouldn't you have a rule like this:
> pass in [log] quick on $ext_if inet proto ipv6 from $tbipv4 to $ext_addr
 
> That is what I had to use to get tunneled ipv6 traffic through.

i shouldn't need a rule that broad to get icmp echo reply through, but i
gave it a shot anyway. since i wasn't sure what you intended by $tbipv4 and
$ext_addr, i put in any/any for 10 seconds to see if the echo replies
started getting through:

pass in log quick on $ext_if inet6 proto ipv6 from any to any

they did not, they're still falling through and getting blocked by the
catchall blocking rule.

richard
--
Richard Welty                                         rwelty@averillpark.net
Averill Park Networking                                         518-573-7592
    Java, PHP, PostgreSQL, Unix, Linux, IP Network Engineering, Security