Re: rule for any IPv6 address
"Dan Mahoney (ports)" <[email protected]> Sun, 19 Apr 2026 13:10:15 -0700
| Newsgroups | gmane.os.freebsd.devel.ipfw |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_DE63CAE9-98C7-4723-B15D-EDB891F7FF85 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Apr 19, 2026, at 1:06=E2=80=AFPM, Dan Mahoney (ports) = <[email protected]> wrote: >=20 > Whoops, sent from wrong address. >=20 >> On Apr 19, 2026, at 3:07=E2=80=AFAM, Marco Moock <[email protected]> = wrote: >>=20 >> Hello! >>=20 >> # ipfw add 01000 allow tcp from ::/0 to me 80 >> 01000 allow tcp from me6 to me 80 >=20 >=20 > # ipfw add 65500 allow ip6 from any to me 80 proto tcp > 65500 allow ip6 from any to me6 80 proto tcp >=20 > note that the kernel then interprets me as "me6" since it knows it's = an ipv6 me. >=20 > Yeah, it might be useful if there was aliases for: >=20 > allow tcp6 from any to me, that under the hood got rendered as: >=20 > allow ip6 from any to me6 proto tcp >=20 > But yeah, this seems to be The Way. >=20 > Also note that while reading the manpage for this, I found a weird = mention of "inner" protocols that I pushed a docbug for. >=20 > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D294648 Oh, also, the fact that your ipfw interpreted ::/0 as "me6" also feels = like a bug. Perhaps someone else could comment on that. -Dan --Apple-Mail=_DE63CAE9-98C7-4723-B15D-EDB891F7FF85 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html aria-label=3D"message body"><head><meta http-equiv=3D"content-type" = content=3D"text/html; charset=3Dutf-8"></head><body = style=3D"overflow-wrap: break-word; -webkit-nbsp-mode: space; = line-break: after-white-space;"><br = id=3D"lineBreakAtBeginningOfMessage"><div><br><blockquote = type=3D"cite"><div>On Apr 19, 2026, at 1:06=E2=80=AFPM, Dan Mahoney = (ports) <[email protected]> wrote:</div><br = class=3D"Apple-interchange-newline"><div><meta http-equiv=3D"content-type"= content=3D"text/html; charset=3Dutf-8"><div style=3D"overflow-wrap: = break-word; -webkit-nbsp-mode: space; line-break: = after-white-space;">Whoops, sent from wrong = address.<div><div><br><blockquote type=3D"cite"><div>On Apr 19, 2026, at = 3:07=E2=80=AFAM, Marco Moock <[email protected]> wrote:</div><br = class=3D"Apple-interchange-newline"><div><div>Hello!<br><br># ipfw add = 01000 allow tcp from ::/0 to me 80<br>01000 allow tcp from me6 to me = 80</div></div></blockquote></div></div><div><div><br></div><div># ipfw = add 65500 allow ip6 from any to me 80 proto tcp</div><div>65500 allow = ip6 from any to me6 80 proto tcp</div><div><br></div><div>note that the = kernel then interprets me as "me6" since it knows it's an ipv6 = me.</div><div><br></div><div>Yeah, it might be useful if there was = aliases for:</div><div><br></div><div>allow tcp6 from any to me, that = under the hood got rendered as:</div><div><br></div><div>allow ip6 from = any to me6 proto tcp</div><div><br></div><div>But yeah, this seems to be = The Way.</div><div><br></div><div>Also note that while reading the = manpage for this, I found a weird mention of "inner" protocols that I = pushed a docbug for.</div><div><br></div><div><a = href=3D"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D294648">https:= //bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D294648</a></div></div></div>= </div></blockquote><br></div><div>Oh, also, the fact that your ipfw = interpreted ::/0 as "me6" also feels like a bug. Perhaps someone = else could comment on = that.</div><div><br></div><div>-Dan</div><br></body></html>= --Apple-Mail=_DE63CAE9-98C7-4723-B15D-EDB891F7FF85--