Filtering MLD messages

Marek Küthe <[email protected]> Sun, 30 Nov 2025 21:04:01 +0000

Newsgroups	gmane.comp.security.firewalls.netfilter.general
Message-ID	<20251130210401.77c74ee1@ciel>

Hello,

I would like to filter MLD messages:
1. Only MLD listener queries and MLD2 listener reports should be
allowed.
2. The messages must have a hop limit of 1.
3. The messages must have a hop-by-hop extension header.
4. The messages must have the router alert option set in the hop-by-hop
extension header.
5. The source address is in the link-local range.

```
set icmp6_mld {
    type icmpv6_type . icmpv6_code;
    flags interval;
    elements = {
        mld-listener-query . 0,
        mld2-listener-report . 0
    };
}

[...]

icmpv6 type . icmpv6 code @icmp6_mld ip6 hoplimit 1 exthdr hbh exists ip6 saddr fe80::/10 counter accept;
```

I have managed to write 1-3 and 5, but I don't know how to filter
the Router Alert option. I have seen that there is `ip option ra`, but
it doesn't seem to work for IPv6. Does anyone know how to write such a
filter?

I would really appreciate some help!

Best regards,
Marek Küthe

-- 
Marek Küthe
[email protected]
er/ihm he/him

signature.asc (application/pgp-signature, 833 B)