Re: [PATCH nf] netfilter: ip6t_rpfilter: set F_IFACE for linklocal addresses

2018-08-16 Thread Pablo Neira Ayuso
On Wed, Jul 25, 2018 at 09:38:43PM +0200, Florian Westphal wrote: > Roman reports that DHCPv6 client no longer sees replies from server > due to > > ip6tables -t raw -A PREROUTING -m rpfilter --invert -j DROP > > rule. We need to set the F_IFACE flag for linklocal addresses, they > are scoped

[PATCH nf] netfilter: ip6t_rpfilter: set F_IFACE for linklocal addresses

2018-07-25 Thread Florian Westphal
Roman reports that DHCPv6 client no longer sees replies from server due to ip6tables -t raw -A PREROUTING -m rpfilter --invert -j DROP rule. We need to set the F_IFACE flag for linklocal addresses, they are scoped per-device. Fixes: 47b7e7f82802 ("netfilter: don't set F_IFACE on ipv6 fib