Re: PF dropping fragmented icmp6 packets

On Thu, Jan 15, 2004 at 02:29:30PM +0000, John Wright wrote:

> This is my pf.conf file:

Your ruleset must allow

  a) inet proto ipv6 on sis0
  b) inet6 proto icmp6 on gif0

An icmp6 echo request will first pass through gif0 natively (inet6 proto
icmp6) then get encapsulated and pass through the real interface (inet
proto ipv6), the echo reply similarly pass through both interface in
reverse order. If you block query or reply on either interface, ping6
won't see the replies.

See http://www.benzedrine.cx/gif.txt for an example setup including
minimal ruleset.

Now, even with a correct ruleset, I can reproduce a problem (scrubbing
dropping reply fragments), so I'll investigate that bug. But with a
correct ruleset, you should see the replies, at least if you temporarily
disable scrubbing for ipv6 (or just icmp6).

Daniel