Re: pf match ipv6 interface ID

 
 
"Sonic" [email protected] – 29 June 2026 at 11:36 pm
> Is it possible to write pf pass/block rules that match the ipv6
> interface ID and ignore the prefix (a wildcard prefix if that makes
> sense)?
> As my ISP's assigned prefix is not static/stable, and my systems
> always create the same IID when using SLAAC, it would really be
> helpful to have this feature for ipv6 firewalling.
 
Does (network_if:0) not work here?
 
pass in on $ext_if inet6 to ($ext_if:0) port https
 
Which will handle changes to the address on the interface?
 
Do you have an example (minus your real address) of what you are looking for?
 
Cheers,
 
Jason.