{"id":202,"date":"2016-01-30T10:45:48","date_gmt":"2016-01-30T15:45:48","guid":{"rendered":"http:\/\/myblog.vindaloo.com\/?p=202"},"modified":"2016-01-30T10:54:06","modified_gmt":"2016-01-30T15:54:06","slug":"pf-required-pass-proto-ipv6-frag-all","status":"publish","type":"post","link":"http:\/\/myblog.vindaloo.com\/?p=202","title":{"rendered":"pf required: pass proto ipv6-frag all"},"content":{"rendered":"<p>FreeBSD&#8217;s pf has serious problems with ipv6 fragment handling. The problems cascade into other issues like named axfr time outs. \u00a0Add this, &#8220;pass proto ipv6-frag all&#8221;, to your ruleset somewhere near your antispoof rules to fix this.<\/p>\n<p>Much of the issue is that the FreeBSD team has diverged their version of the pf firewall so far from the OpenBSD version that they cannot incorporate upstream fixes. I&#8217;m not making my situation any better by sticking with FreeBSD 9. Some of this is probably addressed in FreeBSD 10.<\/p>\n<p>While this persists the best course of action is probably to make sure it works on OpenBSD first, then figure out how to deal with any FreeBSD issues.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>FreeBSD&#8217;s pf has serious problems with ipv6 fragment handling. The problems cascade into other issues like named axfr time outs. \u00a0Add this, &#8220;pass proto ipv6-frag all&#8221;, to your ruleset somewhere near your antispoof rules to fix this. Much of the issue is that the FreeBSD team has diverged their version of the pf firewall so &hellip; <\/p>\n<p class=\"link-more\"><a href=\"http:\/\/myblog.vindaloo.com\/?p=202\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;pf required: pass proto ipv6-frag all&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-202","post","type-post","status-publish","format-standard","hentry","category-freebsd"],"_links":{"self":[{"href":"http:\/\/myblog.vindaloo.com\/index.php?rest_route=\/wp\/v2\/posts\/202","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/myblog.vindaloo.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/myblog.vindaloo.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/myblog.vindaloo.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/myblog.vindaloo.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=202"}],"version-history":[{"count":3,"href":"http:\/\/myblog.vindaloo.com\/index.php?rest_route=\/wp\/v2\/posts\/202\/revisions"}],"predecessor-version":[{"id":205,"href":"http:\/\/myblog.vindaloo.com\/index.php?rest_route=\/wp\/v2\/posts\/202\/revisions\/205"}],"wp:attachment":[{"href":"http:\/\/myblog.vindaloo.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=202"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/myblog.vindaloo.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=202"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/myblog.vindaloo.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=202"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}