Default IPv6 firewall config?

[mokodi]

What's the default firewall configuration for the Asus Merlin FW? For example, I know that it allows IPv6 ICMP traffic by default. Does it allow all kinds of ICMP traffic or only certain types?

 

[RMerlin]

What's the default firewall configuration for the Asus Merlin FW? For example, I know that it allows IPv6 ICMP traffic by default. Does it allow all kinds of ICMP traffic or only certain types?

By default it only allows ICMP traffic which should be allowed as per RFC 4890. See sections 4.3.1 and 4.4.1 of that RFC.

 

[mokodi]

By default it only allows ICMP traffic which should be allowed as per RFC 4890. See sections 4.3.1 and 4.4.1 of that RFC.

Does that mean all ICMP traffic? Some routers like Vyos allow you to specify specific ICMP types to go through. See last post here.


https://community.ubnt.com/t5/EdgeMAX/ipv6-firewall-question/td-p/1142244

 

[RMerlin]

Does that mean all ICMP traffic? Some routers like Vyos allow you to specify specific ICMP types to go through. See last post here.


https://community.ubnt.com/t5/EdgeMAX/ipv6-firewall-question/td-p/1142244

No, only the ICMP protocols enumerated in the two RFC sections I mentioned are allowed by default, as this is mandatory for proper IPv6 operations. All other ICMP protocols are dropped, unless you create a firewall rule to allow them explicitly. Setting the type to "Other" allows you to enter the protocol number in the port field (same as the IPv4 firewall).

 

[mokodi]

No, only the ICMP protocols enumerated in the two RFC sections I mentioned are allowed by default, as this is mandatory for proper IPv6 operations. All other ICMP protocols are dropped, unless you create a firewall rule to allow them explicitly. Setting the type to "Other" allows you to enter the protocol number in the port field (same as the IPv4 firewall).

Thanks RMerlin. I'm glad you're reading the RFC and implementing accordingly. Some vendors like Netgear simply block all IPv6 ICMP without any way to change the settings citing "security issues".

 

[RMerlin]

Thanks RMerlin. I'm glad you're reading the RFC and implementing accordingly. Some vendors like Netgear simply block all IPv6 ICMP without any way to change the settings citing "security issues".

This was done by Asus, not by me. While I did develop the configurable firewall, the default rules were all implemented by Asus.