Hello Logan,

I had no time to try it out yet. there is one thing, which caught my eye in
your description. See my in-line question further below.

On Mon, May 18, 2020 at 04:21:05AM +0000, Logan Dunbar wrote:
> I had to forward this in because my ISP blocks SMTP, apologies if the 
> formatting is incorrect.
> 
> >Synopsis: PF divert-packet does not work with IPv6, only IPv4
> >Category: kernel
> >Environment:
> System      : OpenBSD 6.7
> Details     : OpenBSD 6.7-current (GENERIC.MP) #194: Sun May 17 09:52:26 MDT 
> 2020
> [email protected]:/usr/src/sys/arch/amd64/compile/GENERIC.MP
> 
> Architecture: OpenBSD.amd64
> Machine     : amd64
> >Description:
> Recently, I have set up Suricata on OpenBSD and was able to get it to work 
> with IPv4 using divert-packet. However, when I attempted to use IPv6 using 
> divert-packet, I lost all connectivity.
> >How-To-Repeat:
> When I used this rule:
> pass out on $lan inet divert-packet port 700
> 
> It worked with only IPv4, as it should, but it diverted perfectly.
> 
> When I attempted this rule:
> pass out on $lan inet6 divert-packet port 700

    perhaps you may want to adjust the rule a bit to ignore link-scope
    addresses:

    pass out on $lan inet6 from !fe80::/64 to !fe80::/64 divert-packet port 700

    modification above may help to get your IPv6 connectivity back.


Hope it helps
regards
sashan

Reply via email to