Package: ferm
Version: 2.7-9
Severity: normal
Tags: ipv6
Dear Maintainer,
ferm-early.service runs before network-pre.target and ferm.service runs
after network-online.target.
network-online.target might (systemd/Network-Manager) rely on DHCPv6,
but there's no support for DHCPv6 in ferm-early.service, meaning that
network-online.target will hang waiting for a DHCPv6 reply which is
filtered.
DHCPv4 works because DHCPv4 clients will typically use a raw socket and
later unicast (which will be handled by conntracking), but DHCPv6 sends
multicast messages and receives a reply via a link-local address, so
that's not something conntrack can handle.
As a workaround, I've added this as /etc/ferm/ferm-early.d/dhcpv6.conf:
domain ip6 table filter chain INPUT {
proto udp saddr fe80::/10 sport 547 dport 546 ACCEPT;
proto ipv6-icmp ACCEPT;
}
Which works for me (the icmp part isn't strictly necessary, more for
feature-parity with IPv4), but it would be nice if this was supported
correctly out of the box.
--
David Härdeman
