On Tue, May 26, 2020 at 03:26:28PM -0700, Kenneth Porter wrote:
I found this rule would let packets pass:
firewall-cmd --permanent --direct --add-rule ipv6 filter FWDO_external_allow
0Â -m conntrack --ctstate NEW,UNTRACKED -j ACCEPT
(external is the zone with the WAN-facing interface.)
I can now send a ping from a LAN client (Windows 10) but it times out. I've
disabled the WIndows firewall for testing to remove that variable.
However, tcpdump shows neighbor solicitations going out to the LAN clientÂ
but no replies (neighbor announcement), so it has no place to send the
replies from the Internet site being pinged. I'm trying to track down the
problem there.
You probably need to allow IPv6 ICMP ND types explicitly. Both in
IN_external_allow and FWDI_external_allow.
At least these IPv6 ICMP types:
- neighbour-solicitation
- neighbour-advertisement
- router-advertisement
- redirect
IPv4 pings to the same site work fine. I saved my iptables and
ip6tables
rules to files and diff'd them and don't see a difference now except for the
different kinds of icmp used for error replies.
Probably because ARP works. Firewalld does not block ARP as it's not
really an IP packet.