IPv6 and ICMPv6
IPv6 has its own rulesets (firewall ipv6 …), and one trap that IPv4 doesn't have: IPv6 can't work at all without ICMPv6.
In IPv4, finding a neighbour's MAC address uses ARP, which isn't IP and never reaches the firewall. In IPv6 the same job is done by Neighbour Discovery (NDP), which is ICMPv6. So an input filter that drops "everything except ping" also drops the neighbour solicitations and advertisements the router needs to answer.
The lab's first IPv6 input filter did exactly that. lanhost couldn't ping its gateway, couldn't reach the internet, and its neighbour table shows why: the router's address is FAILED, never resolved. The input filter's default action counted the dropped Neighbour Discovery packets.
The fix is a short list of ICMPv6 types every IPv6 firewall should allow to the router:
| Type | Why |
|---|---|
nd-neighbor-solicit, nd-neighbor-advert | Neighbour Discovery: IPv6's ARP |
nd-router-solicit | Hosts asking for Router Advertisements (if the router sends them) |
packet-too-big | Path MTU discovery. IPv6 routers never fragment, so without this, large packets silently vanish |
destination-unreachable, time-exceeded, parameter-problem | Errors that make failures fast instead of slow, and traceroute work |
In the forward filter, allow at least packet-too-big and the other errors; the lab allows all ICMPv6 through. With the types allowed, lanhost resolves the router at once and reaches the internet over IPv6.
set firewall ipv6 input filter default-action 'drop'
set firewall ipv6 input filter rule 10 action 'accept'
set firewall ipv6 input filter rule 10 icmpv6 type-name 'echo-request'
set firewall ipv6 input filter rule 10 protocol 'ipv6-icmp'
set firewall ipv6 forward filter default-action 'drop'
set firewall ipv6 forward filter rule 10 action 'accept'
set firewall ipv6 forward filter rule 10 description 'LAN may browse the web'
set firewall ipv6 forward filter rule 10 inbound-interface group 'LAN-IFS'
set firewall ipv6 forward filter rule 10 protocol 'tcp'
set firewall ipv6 forward filter rule 10 destination group port-group 'WEB-PORTS'- Lines 1–4: Default drop, and only echo-request accepted.
- Lines 5–10: The forward filter: the LAN may browse the web.
root@lanhost:~# ping -6 -c 2 -W 1 2001:db8:10::1 | tail -2
2 packets transmitted, 0 received, 100% packet loss, time 1066ms
root@lanhost:~# curl -s -m 3 http://[2001:db8:f000::10]/ || echo "no answer"
no answer
root@lanhost:~# ip -6 neigh show dev eth0
2001:db8:10::1 FAILED- Lines 1–6: No ping to the router, no internet.
- Lines 8–9: The router's address was never resolved: Neighbour Discovery was dropped.
vyos@R1:~$ show firewall ipv6 input filter
Ruleset Information
---------------------------------
ipv6 Firewall "input filter"
Rule Action Protocol Packets Bytes Conditions
------- -------- ---------- --------- ------- ------------------------------------
10 accept ipv6-icmp 0 0 icmpv6 type echo-request accept
default drop all 7 440 comment "INP-filter default-action "- Line 10: Neighbour solicitations and advertisements, counted by the default drop.
set firewall ipv6 input filter rule 20 action 'accept'
set firewall ipv6 input filter rule 20 description 'Neighbour Discovery: IPv6 needs it like IPv4 needs ARP'
set firewall ipv6 input filter rule 20 icmpv6 type-name 'nd-neighbor-solicit'
set firewall ipv6 input filter rule 20 protocol 'ipv6-icmp'
set firewall ipv6 input filter rule 21 action 'accept'
set firewall ipv6 input filter rule 21 icmpv6 type-name 'nd-neighbor-advert'
set firewall ipv6 input filter rule 21 protocol 'ipv6-icmp'
set firewall ipv6 input filter rule 22 action 'accept'
set firewall ipv6 input filter rule 22 icmpv6 type-name 'nd-router-solicit'
set firewall ipv6 input filter rule 22 protocol 'ipv6-icmp'
set firewall ipv6 input filter rule 30 action 'accept'
set firewall ipv6 input filter rule 30 description 'Errors that make IPv6 work: never block packet-too-big'
set firewall ipv6 input filter rule 30 icmpv6 type-name 'packet-too-big'
set firewall ipv6 input filter rule 30 protocol 'ipv6-icmp'
set firewall ipv6 input filter rule 31 action 'accept'
set firewall ipv6 input filter rule 31 icmpv6 type-name 'destination-unreachable'
set firewall ipv6 input filter rule 31 protocol 'ipv6-icmp'
set firewall ipv6 input filter rule 32 action 'accept'
set firewall ipv6 input filter rule 32 icmpv6 type-name 'time-exceeded'
set firewall ipv6 input filter rule 32 protocol 'ipv6-icmp'
set firewall ipv6 input filter rule 33 action 'accept'
set firewall ipv6 input filter rule 33 icmpv6 type-name 'parameter-problem'
set firewall ipv6 input filter rule 33 protocol 'ipv6-icmp'
set firewall ipv6 forward filter rule 20 action 'accept'
set firewall ipv6 forward filter rule 20 description 'Echo and the ICMPv6 errors, in both directions'
set firewall ipv6 forward filter rule 20 protocol 'ipv6-icmp'- Lines 1–7: Neighbour Discovery, both directions.
- Lines 8–10: Router solicitations, for when the router sends Router Advertisements.
- Lines 11–23: The errors.
packet-too-bigmatters most. - Lines 24–26: Through the router: all ICMPv6, including the errors.
root@lanhost:~# ping -6 -c 2 -W 1 2001:db8:10::1 | tail -2
2 packets transmitted, 2 received, 0% packet loss, time 1011ms
rtt min/avg/max/mdev = 2.189/5.332/8.476/3.143 ms
root@lanhost:~# curl -s -m 3 http://[2001:db8:f000::10]/ || echo "no answer"
hello from home
root@lanhost:~# ip -6 neigh show dev eth0
2001:db8:10::1 lladdr 52:54:00:11:01:01 router REACHABLE- Lines 1–6: Gateway and internet both reachable.
- Lines 8–9: The router's MAC address, resolved.
Check your understanding
Why can an IPv4 input filter that drops everything except ping leave hosts working, while the same IPv6 filter breaks them?
- IPv4 finds neighbours with ARP, which isn't IP and bypasses the IP firewall; IPv6 uses ICMPv6 Neighbour Discovery, which the filter drops.
- VyOS automatically allows ICMP for IPv4.
- IPv6 hosts need the router to answer pings.
- IPv6 doesn't support default-action drop.