![pf 阻止所有 IPv6 流量](https://linux22.com/image/690677/pf%20%E9%98%BB%E6%AD%A2%E6%89%80%E6%9C%89%20IPv6%20%E6%B5%81%E9%87%8F.png)
以下pf.conf
(FreeBSD 10.3)似乎阻止了所有 IPv6 流量,但我不知道原因。
tcp_inbound = "{ ssh, domain, http, https }"
tcp_outbound = "{ domain, http, https, imaps, smtps }"
udp_services = "{ domain, ntp }"
block all
pass proto udp to any port $udp_services keep state
pass out proto tcp to any port $tcp_outbound keep state
pass in proto tcp to any port $tcp_inbound keep state
# from https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist/
table <github> { 192.30.252.0/22, 2620:112:3000::/44 }
pass out proto tcp to <github> port { ssh } keep state
pass proto icmp from any to any
如何在允许 IPv4 的相同服务上允许 IPv6 流量?我添加了inet6
每条规则的明确版本,但似乎没有帮助。如果我禁用,pf
那么 IPv6 流量就可以顺利通过。
答案1
通过启用日志记录,我设法弄清楚这是因为 ICMP6 路由器请求被阻止了。添加
pass proto ipv6-icmp from any to any
到文件末尾解决了该问题。