On Fri, 23 Jan 2009, Jozsef Kadlecsik wrote: > On Fri, 23 Jan 2009, Eric Leblond wrote: > > > > How about just using NOTRACK target ? > > > > This is a possible solution but you will then have to be a Netfilter > > Jedi to build a correct IPv6 filtering ruleset. I think even Padawan > > have no clue about the existence of the NOTRACK target. > > > > Seriously speaking, the NOTRACK target is tagged "NETFILTER_ADVANCED" > > and IPv6 is becoming more and more frequent. I don't think we should use > > such a complicated solution for simply obtaining an IPv6 address. We > > will loose quit a bunch of users on this. > > RFC4890, Recommendations for Filtering ICMPv6 Messages in Firewalls, deals > with ICMPv6 filtering on firewalls in details and even contains a sample > ip6tables script. > > Wouldn't it make sense to add simply the RFC to the iptables source tree, > and a sentence to the ip6tables manpage saying: > > "Please read RFC 4890 and the sample script in it on how to filter ICMPv6 > properly in an IPv6 environment." Looking through the sample script again, it is incomplete as it does not handle the ICMPv6 traffic targeted to/sent from the firewall itself. But it'd be not hard to add the missing rules. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
