1

I have a pfSense 2.2.6 box that is connected with a WAN link that supports native IPv6. IPv6 is working great, and my clients can access IPv6 services on the Internet and also on the local network.

However, I'm unable to ping the clients from the Internet, although I have created an IPv6 rule on the WAN link (and LAN as well) that permits IPv6 ICMP.

Is there anything I'm missing?

|improve this question
  • Oh, I just made a tcpdump on the machine I'm ping6'ing. The ICMP packets actually come in, and I see the host responds. But for some reason it seems it can't pass the WAN. – Daniel Feb 12 '16 at 12:34
  • 1
    Might help to see the rules in question. – Ecnerwal Feb 12 '16 at 13:44
  • Put your rules here, from bot interfaces – Orlando Gaetano Jun 11 '16 at 20:55
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin♦ Aug 13 '17 at 6:23
1

I'm not familiar with the pfSense product line, but ICMP is stateless, and on Cisco firewalls if you aren't "inspecting" ICMP you have to explicitly allow 'echo-reply' or ICMP as a whole on the outbound (or whatever interface you want ping replies to come from) interface.

In Cisco parlance, for your issue, that would be modifying the inside access-list to allow ICMP replies back out.

|improve this answer
1

If destination hosts is sending echo replay response and is not recived by sender. There could be two common issues:

  1. Packet from intranet network is not allowed to go outside.
  2. NAT statment could be missing if NAT is in use.
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.