IPv6 ICMP Echo Response

[owlyn]

I just tested the Merlin IPv6 firewall at http://ipv6.chappell-family.com/ipv6tcptest/. All was perfect, except for

ICMPv6 ECHO REQUEST returned : ECHO REPLY

I don't know if this is a problem, and if the ICMP can/should be blocked. Anyone know?

Thanks.

 

[Deleted member 22229]

I just tested the Merlin IPv6 firewall at http://ipv6.chappell-family.com/ipv6tcptest/. All was perfect, except for

ICMPv6 ECHO REQUEST returned : ECHO REPLY

I don't know if this is a problem, and if the ICMP can/should be blocked. Anyone know?

Thanks.

I get the same thing here, always have. I believe Merlin said it's normal for v6.

 

[RMerlin]

I get the same thing here, always have. I believe Merlin said it's normal for v6.

That's correct. The RFC states that IPv6 nodes are expected to reply to ICMP ECHO requests.

 

[owlyn]

Okay, thanks much Kel and Merlin.

 

[knighthawk]

If you don't want said RFC behavior however to your clients:

ip6tables -D FORWARD -p ipv6-icmp --icmpv6-type 128 -j ACCEPT
ip6tables -D FORWARD -p ipv6-icmp --icmpv6-type 129 -j ACCEPT

In firewall-start script will block responses to unsolicited echo requests while still allowing solicited ones through.