On Fri, 23 Jan 2009, Eric Leblond wrote: > > How about just using NOTRACK target ? > > This is a possible solution but you will then have to be a Netfilter > Jedi to build a correct IPv6 filtering ruleset. I think even Padawan > have no clue about the existence of the NOTRACK target. > > Seriously speaking, the NOTRACK target is tagged "NETFILTER_ADVANCED" > and IPv6 is becoming more and more frequent. I don't think we should use > such a complicated solution for simply obtaining an IPv6 address. We > will loose quit a bunch of users on this. RFC4890, Recommendations for Filtering ICMPv6 Messages in Firewalls, deals with ICMPv6 filtering on firewalls in details and even contains a sample ip6tables script. Wouldn't it make sense to add simply the RFC to the iptables source tree, and a sentence to the ip6tables manpage saying: "Please read RFC 4890 and the sample script in it on how to filter ICMPv6 properly in an IPv6 environment." Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
