From: Jozsef Kadlecsik <kadlec@xxxxxxxxxxxxxxxxx> Date: Fri, 23 Jan 2009 10:50:59 +0100 (CET) > On Fri, 23 Jan 2009, Jozsef Kadlecsik wrote: > > > On Fri, 23 Jan 2009, Eric Leblond wrote: > > > > > > How about just using NOTRACK target ? > > > > > > This is a possible solution but you will then have to be a Netfilter > > > Jedi to build a correct IPv6 filtering ruleset. I think even Padawan > > > have no clue about the existence of the NOTRACK target. > > > > > > Seriously speaking, the NOTRACK target is tagged "NETFILTER_ADVANCED" > > > and IPv6 is becoming more and more frequent. I don't think we should use > > > such a complicated solution for simply obtaining an IPv6 address. We > > > will loose quit a bunch of users on this. > > > > RFC4890, Recommendations for Filtering ICMPv6 Messages in Firewalls, deals > > with ICMPv6 filtering on firewalls in details and even contains a sample > > ip6tables script. > > > > Wouldn't it make sense to add simply the RFC to the iptables source tree, > > and a sentence to the ip6tables manpage saying: > > > > "Please read RFC 4890 and the sample script in it on how to filter ICMPv6 > > properly in an IPv6 environment." > > Looking through the sample script again, it is incomplete as it does not > handle the ICMPv6 traffic targeted to/sent from the firewall itself. But > it'd be not hard to add the missing rules. I looks not to show the recommended rules but just the usage of ip6tables. -- Yasuyuki Kozakai -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
