Home
Help
Search
Login
Register
OPNsense Forum
»
Archive
»
15.7 Legacy Series
»
question about blocked ipv6 icmp in firewall logs
« previous
next »
Print
Pages: [
1
]
Author
Topic: question about blocked ipv6 icmp in firewall logs (Read 10745 times)
packet loss
Full Member
Posts: 134
Karma: 26
question about blocked ipv6 icmp in firewall logs
«
on:
January 15, 2016, 08:51:35 pm »
I constantly see blocked ipv6 icmp traffic in my firewall logs. It's from the same source and destination all the time. My ISP provides me with an ipv4 ip address. I disabled ipv6 in OPNsense. I would like to know why I'm seeing so much ipv6 icmp blocked traffic specifically from the same source and destination?
Logged
franco
Administrator
Hero Member
Posts: 17657
Karma: 1611
Re: question about blocked ipv6 icmp in firewall logs
«
Reply #1 on:
January 15, 2016, 09:44:14 pm »
IPv6 is only completely blocked, not removed from the kernel so some facilities like link-local addresses still pop up and try to communicate. Some software services even communicate using IPv6 addresses with their child processes. It's only natural that this shows up on the logs. I think some tweaking can be done in the "System: Settings: Logs/Reports" page WRT logging on/off for standard rules.
What you're seeing there is Router Advertisement in action, the link local IPv6 probes the link-local multicast address for information. The link-local IPv6 is probably from your WAN interface. You can run ifconfig on the command line to confirm this.
Logged
packet loss
Full Member
Posts: 134
Karma: 26
Re: question about blocked ipv6 icmp in firewall logs
«
Reply #2 on:
January 16, 2016, 06:42:03 am »
This is occurring every 5 seconds which is excessive. Is radvd causing this?
Logged
franco
Administrator
Hero Member
Posts: 17657
Karma: 1611
Re: question about blocked ipv6 icmp in firewall logs
«
Reply #3 on:
January 16, 2016, 10:48:31 am »
I don't think radvd is running.. you can confirm by:
# pgrep radvd
It's the kernel probing, maybe it can be disabled via sysctl, but I'd have to read up on this as well.
Logged
franco
Administrator
Hero Member
Posts: 17657
Karma: 1611
Re: question about blocked ipv6 icmp in firewall logs
«
Reply #4 on:
January 16, 2016, 10:50:23 am »
https://www.freebsd.org/doc/en_US.ISO8859-1/books/developers-handbook/ipv6.html
Section 8.1.1.4.2. may be related.
Logged
packet loss
Full Member
Posts: 134
Karma: 26
Re: question about blocked ipv6 icmp in firewall logs
«
Reply #5 on:
January 16, 2016, 03:57:59 pm »
Good information. Thanks for taking the time out of your coding to answer this question.
Logged
Print
Pages: [
1
]
« previous
next »
OPNsense Forum
»
Archive
»
15.7 Legacy Series
»
question about blocked ipv6 icmp in firewall logs