16
16.1 Legacy Series / Hurricane Electric and policy routing
« on: May 20, 2016, 10:24:49 pm »
Hi
I wanted to use a Hurricane Electric IPv6 tunnel for a separate interface. I followed the steps from here https://forum.opnsense.org/index.php?topic=1992.0, but didn't choose the gif interface as default gateway because I already have an IPv6 default gateway.
In the ruleset for the separate interface I chose the GIF interface as gateway for the allow rules.
With tcpdump I can now see the traffic going through the GIF interface and replying traffic comes back. But the replying traffic gets blocked on the gif Interface. In pfstate I can see NO_TRAFFIC:SINGLE as state. It seems that the firewall can't find the already opened stateful connection for the traffic.
Is there a fix for this?
Regards
Marcel
Btw. NPT doesn't work. It just shows this error.
I wanted to use a Hurricane Electric IPv6 tunnel for a separate interface. I followed the steps from here https://forum.opnsense.org/index.php?topic=1992.0, but didn't choose the gif interface as default gateway because I already have an IPv6 default gateway.
In the ruleset for the separate interface I chose the GIF interface as gateway for the allow rules.
With tcpdump I can now see the traffic going through the GIF interface and replying traffic comes back. But the replying traffic gets blocked on the gif Interface. In pfstate I can see NO_TRAFFIC:SINGLE as state. It seems that the firewall can't find the already opened stateful connection for the traffic.
Is there a fix for this?
Regards
Marcel
Btw. NPT doesn't work. It just shows this error.
Code: [Select]
/usr/local/etc/rc.filter_configure_sync: New alert found: There were error(s) loading the rules: /tmp/rules.debug:60: syntax error - The line in question reads [60]: binat on $HENETV6 from any to prenatprefix::/64 -> postnatprefix::/64