Re: [PATCH 0/2] IPv6 conntrack support for neighbour discovery

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, 23 Jan 2009, Jozsef Kadlecsik wrote:

> On Fri, 23 Jan 2009, Eric Leblond wrote:
> 
> > > How about just using NOTRACK target ?
> > 
> > This is a possible solution but you will then have to be a Netfilter
> > Jedi to build a correct IPv6 filtering ruleset. I think even Padawan
> > have no clue about the existence of the NOTRACK target.
> > 
> > Seriously speaking, the NOTRACK target is tagged "NETFILTER_ADVANCED"
> > and IPv6 is becoming more and more frequent. I don't think we should use
> > such a complicated solution for simply obtaining an IPv6 address. We
> > will loose quit a bunch of users on this.
> 
> RFC4890, Recommendations for Filtering ICMPv6 Messages in Firewalls, deals 
> with ICMPv6 filtering on firewalls in details and even contains a sample 
> ip6tables script.
> 
> Wouldn't it make sense to add simply the RFC to the iptables source tree, 
> and a sentence to the ip6tables manpage saying:
> 
> "Please read RFC 4890 and the sample script in it on how to filter ICMPv6
> properly in an IPv6 environment."

Looking through the sample script again, it is incomplete as it does not 
handle the ICMPv6 traffic targeted to/sent from the firewall itself. But 
it'd be not hard to add the missing rules.

Best regards,
Jozsef
-
E-mail  : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux