Re: inet6 packet filter question: link local address vs antispoof

2017-06-20 Thread Harald Dunkel
Hi Martin, the host I had used for testing is off, so I had to switch. After disabling the packet filter I see: # tcpdump -i re0 -env icmp6 tcpdump: listening on re0, link-type EN10MB 20:58:08.865529 20:cf:30:e8:0d:58 52:54:00:2e:f3:25 86dd 118: fe80::22cf:30ff:fee8:d58 >

Re: inet6 packet filter question: link local address vs antispoof

2017-06-20 Thread Martin Pieuchot
On 11/06/17(Sun) 16:23, Harald Dunkel wrote: > PS #1: Outgoing traffic to a link-local address initiated by the > gateway is not corrupted. > > PS #2: It seems that OpenBSD 6.0 doesn't show this problem. Could you use tcpdump on 6.0, do you spot any difference?

Re: inet6 packet filter question: link local address vs antispoof

2017-06-20 Thread Martin Pieuchot
On 11/06/17(Sun) 15:51, Harald Dunkel wrote: > Hi folks, > > pf.conf on my gateway (6.1) says > > bash-4.4# pfctl -sr | egrep -i icmp\|block > block return log all > : > : > pass quick inet proto icmp all keep state (if-bound) > pass quick inet6 proto ipv6-icmp all keep state (if-bound) > >

inet6 packet filter question: link local address vs antispoof

2017-06-11 Thread Harald Dunkel
Hi folks, pf.conf on my gateway (6.1) says bash-4.4# pfctl -sr | egrep -i icmp\|block block return log all : : pass quick inet proto icmp all keep state (if-bound) pass quick inet6 proto ipv6-icmp all keep state (if-bound) Problem is, a ping6 to the gateway's link local address is not answered.

Re: inet6 packet filter question: link local address vs antispoof

2017-06-11 Thread Harald Dunkel
PS #1: Outgoing traffic to a link-local address initiated by the gateway is not corrupted. PS #2: It seems that OpenBSD 6.0 doesn't show this problem. Regards Harri