Project

General

Profile

Actions

Bug #2598

closed

reply-to on IPv4+6 rules breaks v6

Added by Chris Buechler over 9 years ago. Updated almost 9 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
Rules / NAT
Target version:
Start date:
08/16/2012
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.1-IPv6
Affected Architecture:

Description

The auto-added reply-to on WAN rules in combination with IPv4+v6 rules breaks v6 connectivity, as the v4 IP is included as the reply-to address. Work around is just disabling the reply-to, at least where that's feasible. PF seems to ignore any v6 matching the rule if a v4 reply-to is specified, as it's not just being improperly routed, it's being logged as blocked.

There isn't a clean easy answer here. Splitting the rule, where it requires reply-to or route-to, into two separate rules in rules.debug is probably the best solution.

Actions #1

Updated by Ermal Luçi almost 9 years ago

  • Status changed from New to Feedback

Patch committed.

Actions #2

Updated by Ermal Luçi almost 9 years ago

  • % Done changed from 0 to 100
Actions #3

Updated by Bernhard Lichtinger almost 9 years ago

This works now for dualstack rules on WAN. But it also creates 2 separate rules on other (OPT) interfaces for dual-stack rules, which is not needed. But I think it does not harm either.
Checked on 2.1-BETA1 (amd64) built on Sun Feb 24 10:55:18 EST 2013

Actions #4

Updated by Jim Pingle almost 9 years ago

  • Status changed from Feedback to Resolved

It creates two rules because it has to. On WAN without the default gateway it needs to add reply-to on the rules separately, the IPv4 rule needs the IPv4 gateway, on IPv6 it needs the IPv6 gateway. Can't do that in a single rule, so it's working as intended.

Actions

Also available in: Atom PDF