Hi, On Fri, Apr 29, 2016 at 09:38:50AM +0200, Shane Kerr wrote: > OTOH, blocking all IPv6 fragments seems a bit too aggressive for > firewalls.
My guess is more along the lines of "this is on FreeBSD, using the pf(4)
packet filter, which is still not able to do anything reasonable with
IPv6 fragments" (you can permit-all or deny-all, but no reassembly and
no more educated filtering).
OpenBSD fixed that, but FreeBSD changed their networking stack enough
that they cannot just import new versions of pf(4) from OpenBSD anymore
(and it seems nobody really cares *sigh*).
We're using NAT64 techniques to access customer private networks (using
ULAs mapped to their private addresses on the outside) and these atomic
fragments + FreeBSD pf(4) has bitten us as well...
Gert Doering
-- NetMaster
--
have you enabled IPv6 on something today...?
SpaceNet AG Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen HRB: 136055 (AG Muenchen)
Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279
signature.asc
Description: PGP signature
