ipfstat not displaying ipv6 icmp rules?

--00163630fc31d8fa4904a1da8bf0
Content-Type: text/plain; charset=ISO-8859-1

Hi,

I have ipf version 4.1.28 on my system (FreeBSD7.2). I did search the
archive and found something similar:

http://marc.info/?l=ipfilter&m=101246930105753&w=2

In the rc.conf file I have ipv6_ipfilter_rules="/etc/ipf6.base.rules". The
end part of the rules file looks like this:

##########################
....
....
pass in quick proto ipv6-icmp all icmp-type 134 #Router advertisement
pass in quick proto ipv6-icmp all icmp-type 135 #Neighbor solicitation
pass in quick proto ipv6-icmp all icmp-type 136 #Neighbor advertisement
pass in quick proto ipv6-icmp all icmp-type 137 #Redirect from routers
pass in quick proto ipv6-icmp all icmp-type 2 #packet too big
block in quick all
pass out quick proto tcp all keep state
pass out quick proto udp all keep state
pass out quick proto ipv6-icmp all
block in quick proto ipv6-icmp all
##########################

This is what ipfstat prints out:

bash-3.2$ sudo ipfstat -6io
pass out quick on lo0 all
pass out quick on lofb all
pass out quick proto tcp/udp from any to any port = domain keep state
pass out quick proto tcp from any to any keep state
pass out quick proto udp from any to any keep state
pass out quick proto ipv6-icmp from any to any
pass in quick on lo0 all
pass in quick on lofb all
pass in quick from any to any with frag
pass in quick proto tcp/udp from any to any port = ntp keep state
pass in quick proto tcp from any to any port = https keep state
pass in quick proto tcp from any to any port = telnet keep state
pass in quick proto tcp from any to any port = ssh keep state
pass in quick proto tcp/udp from any to any port = sunrpc keep state
block return-rst in quick proto tcp from any to any port = auth
block in quick proto udp from any to any port = auth
block return-rst in quick proto tcp from any to any port = echo
block return-rst in quick proto tcp from any to any port = http
block return-rst in quick proto tcp from any to any port = kshell
block in quick proto udp from any to any port = http
pass in quick proto tcp/udp from any to any port > 1023 keep state
pass in quick proto ipv6-icmp from any to any
pass in quick proto ipv6-icmp from any to any
pass in quick proto ipv6-icmp from any to any
pass in quick proto ipv6-icmp from any to any
pass in quick proto ipv6-icmp from any to any
block in quick all
block in quick proto ipv6-icmp from any to any

Is it that ipfstat is not displaying the icmp-type for IPv6 or there's
something that's missing? Please let me know.

Questions 2: While specifying IPv4 and Ipv6 rules in two different files, is
it a must to include TCP rules in both (and make them same to have same
behavior)?


Best regards,

--00163630fc31d8fa4904a1da8bf0
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi,<br><br>I have ipf version 4.1.28 on my system (FreeBSD7.2). I did searc=
h the archive and found something similar:<br><br><a href=3D"http://marc.in=
fo/?l=3Dipfilter&amp;m=3D101246930105753&amp;w=3D2" class=3D"external free"=
 title=3D"http://marc.info/?l=3Dipfilter&amp;m=3D101246930105753&amp;w=3D2"=
 rel=3D"nofollow">http://marc.info/?l=3Dipfilter&amp;m=3D101246930105753&am=
p;w=3D2</a><br>
<br>In the rc.conf file I have ipv6_ipfilter_rules=3D&quot;/etc/ipf6.base.r=
ules&quot;. The end part of the rules file looks like this:<br><br>########=
##################<br>.... <br>....<br>pass in quick proto ipv6-icmp all ic=
mp-type 134 #Router advertisement<br>
pass in quick proto ipv6-icmp all icmp-type 135 #Neighbor solicitation<br>p=
ass in quick proto ipv6-icmp all icmp-type 136 #Neighbor advertisement<br>p=
ass in quick proto ipv6-icmp all icmp-type 137 #Redirect from routers<br>
pass in quick proto ipv6-icmp all icmp-type 2 #packet too big<br>block in q=
uick all<br>pass out quick proto tcp all keep state<br>pass out quick proto=
 udp all keep state<br>pass out quick proto ipv6-icmp all<br>block in quick=
 proto ipv6-icmp all<br>
##########################<br><br>This is what ipfstat prints out:<br><br>b=
ash-3.2$ sudo ipfstat -6io<br>pass out quick on lo0 all<br>pass out quick o=
n lofb all<br>pass out quick proto tcp/udp from any to any port =3D domain =
keep state<br>
pass out quick proto tcp from any to any keep state<br>pass out quick proto=
 udp from any to any keep state<br>pass out quick proto ipv6-icmp from any =
to any<br>pass in quick on lo0 all<br>pass in quick on lofb all<br>pass in =
quick from any to any with frag<br>
pass in quick proto tcp/udp from any to any port =3D ntp keep state<br>pass=
 in quick proto tcp from any to any port =3D https keep state<br>pass in qu=
ick proto tcp from any to any port =3D telnet keep state<br>pass in quick p=
roto tcp from any to any port =3D ssh keep state<br>
pass in quick proto tcp/udp from any to any port =3D sunrpc keep state<br>b=
lock return-rst in quick proto tcp from any to any port =3D auth<br>block i=
n quick proto udp from any to any port =3D auth<br>block return-rst in quic=
k proto tcp from any to any port =3D echo<br>
block return-rst in quick proto tcp from any to any port =3D http<br>block =
return-rst in quick proto tcp from any to any port =3D kshell<br>block in q=
uick proto udp from any to any port =3D http<br>pass in quick proto tcp/udp=
 from any to any port &gt; 1023 keep state<br>
pass in quick proto ipv6-icmp from any to any<br>pass in quick proto ipv6-i=
cmp from any to any<br>pass in quick proto ipv6-icmp from any to any<br>pas=
s in quick proto ipv6-icmp from any to any<br>pass in quick proto ipv6-icmp=
 from any to any<br>
block in quick all<br>block in quick proto ipv6-icmp from any to any<br><br=
>Is it that ipfstat is not displaying the icmp-type for IPv6 or there&#39;s=
 something that&#39;s missing? Please let me know.<br><br>Questions 2: Whil=
e specifying IPv4 and Ipv6 rules in two different files, is it a must to in=
clude TCP rules in both (and make them same to have same behavior)?<br>
<br><br>Best regards,<br><br><br><br><br>

--00163630fc31d8fa4904a1da8bf0--