IPV6-ICMP "Echo service request"

[proctor]

Hello,

there are two options to get Ping for IPv6 to work:

• IPv6 / ICMP / Echo Request
• IPv6 / IPV6-ICMP / Echo service request

What is "Echo service request"? - I got no results searching for that exact phrase.

Thanx for any hint.

[OPNenthu]

ICMP / Echo Request is for IPv4.

Side note: I've seen a bug in OPNsense when editing rules that sometimes the "ICMP / Echo Request" values stick around when changing the IP version from IPv4 to IPv6.  You get an error when trying to save the rule in that case and then you have to just change them to "IPV6-ICMP / Echo service request" manually and re-save.

[proctor]

ICMP / Echo Request is for IPv4.

In context with opnsense firewall you can combine IPv6 with ICMP (echo request) and IPV6-ICMP (echo service request) - both work. To keep it simple, a single rule for IPv4/v6 (any) with ICMP (echo request) seems to work. So my two questions are:

Is there any reason to set up separate rules for IPv4 and IPv6 echo requests instead of a single rule?
Is there any difference between "Echo service request" and "Echo Request"? [1]

[1] I can't find an ICMP/ICMPv6 type "Echo service request" in any context.

[OPNenthu]

In context with opnsense firewall you can combine IPv6 with ICMP (echo request) and IPV6-ICMP (echo service request) - both work. To keep it simple, a single rule for IPv4/v6 (any) with ICMP (echo request) seems to work. So my two questions are:

Hmm, if that does work then 1) it's news to me, and 2) there must be some logic in OPNsense which is creating the two version-specific rules on the backend.  I always just create them separately.  I'm happy to be wrong about this because then I can consolidate my ruleset :)

I think that because icmp and icmp6 are distinct protocols belonging to their respective IP version that 'pf' cannot handle both in a single rule.  IMO, the OPNsense rules GUI is a bit misleading in that it allows you to select them freely.

"Echo request" and "Echo service request" are synonymous, just for their respective version.  Maybe OPNsense maps them intelligently if you choose either one.  I don't know.

You can find references to "Echo request" (type 8) and "Echo service request" (type 128) in the FreeBSD ICMP(4) and ICMP6(4) man pages, respectively:

https://man.freebsd.org/cgi/man.cgi?query=icmp&apropos=0&sektion=0&manpath=FreeBSD+15.1-RELEASE&format=html

https://man.freebsd.org/cgi/man.cgi?query=icmp6&apropos=0&sektion=0&manpath=FreeBSD+15.1-RELEASE&format=html

[drosophila]

From the rules page you have to select either-or. But it does have a combined TCP/UDP type, which also are separate protocols, so it's entirely possible that the same is being done silently for ICMP&6. That would certainly be useful, but for clarity there should be a combined setting instead IMO.

[proctor]

You can find references to "Echo request" (type 8) and "Echo service request" (type 128) in the FreeBSD ICMP(4) and ICMP6(4) man pages ...

Thanks for the links, you are better than DuckDuckGo.

No results found for "Echo service request"

Suggestions:

    Check spelling
    Try related keywords
    Retry search without quotes: Echo service request

[proctor]

From the rules page you have to select either-or. But it does have a combined TCP/UDP type, which also are separate protocols, so it's entirely possible that the same is being done silently for ICMP&6. That would certainly be useful, but for clarity there should be a combined setting instead IMO.

Maybe either-or-any and for all of them you have the choice of ICMP and IPV6-ICMP.

[OPNenthu]

you are better than DuckDuckGo.

Lol, I probably deserved that!