Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

IPv6 policy routing not working #39

Closed
patrick7 opened this issue Apr 16, 2019 · 3 comments
Closed

IPv6 policy routing not working #39

patrick7 opened this issue Apr 16, 2019 · 3 comments

Comments

@patrick7
Copy link

I created an IPv6 firewall rule using a gateway (GIF, WireGuard). The rule matches but traffic is sent to the default gateway (netstat -6rn)

To Reproduce
Steps to reproduce the behavior:

  1. Create an IPv6 firewall rule using a default gateway
  2. Test it

Expected behavior
Routing over the gateway which is specified in the rule

Environment
Software version used and hardware type if relevant.
e.g.:

OPNsense 19.1.6 (amd64, OpenSSL).
AMD APU, KVM VM, ..

Also see https://forum.opnsense.org/index.php?topic=10846.0, https://forum.opnsense.org/index.php?topic=11988.msg57209
@patrick7
Copy link
Author

patrick7 commented Apr 18, 2019 •
edited
Loading

It works when shared forwarding is disabled :o
What does this option exactly in the background?

@fichtner fichtner self-assigned this Apr 22, 2019
@fichtner
Copy link
Member

Looks like a shared forwarding regression in IPv6 code. I'll have a closer look but I'm not sure it will be easy to spot or debug.

Shared forwarding offers a missing piece to the FreeBSD kernel's interaction between pf and ipfw firewall components. The current FreeBSD code "blackholes" policy routing and sends packets out the physical link without handing them off to ipfw which breaks certain combinations on policy routing + shaping or captive portal or transparent proxy use.

@fichtner fichtner transferred this issue from opnsense/core May 6, 2019
@fichtner
Copy link
Member

same as #38

@fichtner fichtner removed their assignment Jul 13, 2019
fichtner added a commit that referenced this issue Dec 13, 2019
@fichtner
netinet6: test fix for forward ifp change request
1bf392c 
PR: #38
PR: #39
lattera pushed a commit to BlackhawkNest/opnsense-src that referenced this issue Oct 30, 2020
@fichtner
netinet6: test fix for forward ifp change request
3b8b8f7 
PR: opnsense#38
PR: opnsense#39
(cherry picked from commit 1bf392c)
Signed-off-by: Shawn Webb <swebb@blackhawknest.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@fichtner @patrick7