On Wed, Jul 25, 2018 at 07:33:17PM +0500, Roman Mamedov wrote: > Hello, > > I have a machine which is a DHCPv6 client on a PPPoE connection. It also has: > > sysctl -w net.netfilter.nf_conntrack_tcp_loose=0 > ip6tables -t raw -A PREROUTING ! -i lo -m rpfilter --invert -j DROP > > After commits: > > netfilter: don't set F_IFACE on ipv6 fib lookups > http://patchwork.ozlabs.org/patch/873574/ > > netfilter: ip6t_rpfilter: provide input interface for route lookup > https://patchwork.ozlabs.org/patch/919290/ > > ...the DHCPv6 client no longer sees any replies from the server. They are now > filtered out by rpfilter. Removing the ip6tables rule shown above, or rolling > back both of these commits, makes it all work fine again. > > From commit messages it doesn't appear like this would be a "by design" > behavior of these changes. > > I did not test if other kernel branches (4.17 et al) are affected, but if they > also have both of these, I guess they likely are. I believe this was fixed by: cede24d1b21d ("netfilter: ip6t_rpfilter: provide input interface for route lookup") which landed in 4.18. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
