From: Florian Westphal <fw@strlen.de>
To: Daniel Huhardeaux <tech@tootai.net>
Cc: netfilter@vger.kernel.org
Subject: Re: IPv6 nft vs ip6tables - Local incompatibility ?
Date: Wed, 30 Oct 2019 18:18:49 +0100 [thread overview]
Message-ID: <20191030171849.GG876@breakpoint.cc> (raw)
In-Reply-To: <f696024b-d134-3470-ff70-27d7e00df9cd@tootai.net>
Daniel Huhardeaux <tech@tootai.net> wrote:
> Hello,
>
> I use nftables in a network where stations are under Ubuntu 18 or Debian
> 9/10.
>
> IPv6 networks are:
> 2a01:YYY:ZZZ:10::9000/128
> 2a01:YYY:ZZZ:10::/64
>
> ICMP rules on 2a01:YYY:ZZZ:10::4
>
> chain output {
> type filter hook output priority 0; policy drop;
> oif "lo" accept
> oif "lan" meta l4proto ipv6-icmp counter packets 0 bytes 0 accept
> oif "lan" ct state established,related,new counter packets 0 bytes 0
> accept
> }
>
> Pinging ipv6 addresses external to the network is working fine.
>
> Pinging a local machine, doesn't matter in which lan, I get "ping sendmsg:
> operation not permitted".
>
> If I change policy to accept, I get
> From 2a01:YYY:ZZZ:10::4 icmp_seq=1 Destination unreachable: Address
> unreachable
>
> If I switch to ip6tables
>
> 96 10892 ACCEPT icmpv6 lan * ::/0 2a01:729:16e:10::4
> 6 1008 ACCEPT icmpv6 lan * ::/0 ::/0
> ipv6-icmptype 134 HL match HL == 255
> 31 2232 ACCEPT icmpv6 lan * ::/0 ::/0
> ipv6-icmptype 135 HL match HL == 255
> 39 2496 ACCEPT icmpv6 lan * ::/0 ::/0
> ipv6-icmptype 136 HL match HL == 255
> 0 0 ACCEPT icmpv6 lan * ::/0 ::/0
> ipv6-icmptype 137 HL match HL == 255
>
> I can ping machines from both lan.
>
> Any clue ?
It looks like nft ruleset tests output, whereas ip6tables checks
input...
next prev parent reply other threads:[~2019-10-30 17:18 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-30 17:04 IPv6 nft vs ip6tables - Local incompatibility ? Daniel Huhardeaux
2019-10-30 17:18 ` Florian Westphal [this message]
2019-10-30 18:04 ` Daniel Huhardeaux
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191030171849.GG876@breakpoint.cc \
--to=fw@strlen.de \
--cc=netfilter@vger.kernel.org \
--cc=tech@tootai.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox