From: stoffl4ever <stoffl4ever@gmail.com>
To: netfilter@vger.kernel.org
Subject: nft icmpv6 mld-listener-query rule not honored?
Date: Tue, 25 Nov 2014 14:27:15 +0100 [thread overview]
Message-ID: <547483B3.6040207@gmail.com> (raw)
Hallo,
I am trying to get a basic nftables set up working but i cannot figure
out why the packets get rejected despite the afaik correct rule to all
this traffic. The overall result is that IPv6 connectivity is lost
because the router seams not to be able to route any IPv6 Traffic to the
host if Type=130 aka. mld-listener-query packets are rejected. May be
someone could help me and correct me where i am wrong or point me to
some documentation that would explain my misconceptions.
SysInfo:
kernel: 3.17.4.201411220955-1-grsec (all nf* modules loaded)
nft: nftables v0.3
Network setup via systemd-networkd: br0(bridge) is attached to
eth0(physical nic)
nft rule set:
table inet filter {
chain input {
type filter hook input priority 0;
ip protocol icmp icmp type { echo-request} accept
ip6 nexthdr ipv6-icmp icmpv6 type { packet-too-big,
mld-listener-query, nd-router-advert, mld-listener-report,
nd-neighbor-advert, nd-neighbor-solicit, echo-reply,
mld-listener-reduction, echo-request, destination-unreachable} accept
log prefix "REJECTED - " counter packets 211 bytes
11718 reject
}
chain forward {
type filter hook forward priority 0;
}
chain output {
type filter hook output priority 0;
}
}
From Log: (interesting message is the second one)
kernel: REJECTED - IN=br0 OUT= PHYSIN=eth0
MAC=01:00:5e:00:00:01:fe:54:00:02:14:8a:08:00 SRC=0.0.0.0 DST=224.0.0.1
LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2
Nov 25 13:49:57
kernel: REJECTED - IN=br0 OUT= PHYSIN=eth0
MAC=33:33:00:00:00:01:fe:54:00:02:14:8a:86:dd
SRC=fe80:0000:0000:0000:8497:04ff:fee4:07e0
DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=1
FLOWLBL=0 PROTO=ICMPv6 TYPE=130 CODE=0
Thank you with best regards,
chris
next reply other threads:[~2014-11-25 13:27 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-11-25 13:27 stoffl4ever [this message]
2014-12-01 12:59 ` nft icmpv6 mld-listener-query rule not honored? Pablo Neira Ayuso
2014-12-01 15:53 ` stoffl4ever
2014-12-01 16:04 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=547483B3.6040207@gmail.com \
--to=stoffl4ever@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.