I’m not sure why I can’t get to the internet from my systems inside my LAN. The gateway can.
Interesting: On the client box, I can’t see any IPv6 traffic leaving the except icmp. The following demonstrates:
Setting up a
$ ifconfig
em0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC>
ether 00:1b:21:51:ab:2d
inet 10.55.0.44 netmask 0xffffff00 broadcast 10.55.0.255
inet6 fe80::21b:21ff:fe51:ab2d%em0 prefixlen 64 scopeid 0x1
inet6 2001:470:1f07:b80:21b:21ff:fe51:ab2d prefixlen 64 autoconf
nd6 options=3<PERFORMNUD,ACCEPT_RTADV>
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
re0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=389b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_UCAST,WOL_MCAST,WOL_MAGIC>
ether e0:cb:4e:42:f0:ff
media: Ethernet autoselect (10baseT/UTP <half-duplex>)
status: no carrier
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=3<RXCSUM,TXCSUM>
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
nd6 options=3<PERFORMNUD,ACCEPT_RTADV>
$ netstat -nr -f inet6
Routing tables
Internet6:
Destination Gateway Flags Netif Expire
::/96 ::1 UGRS lo0 =>
default 2001:470:1f07:b80::1 UGS em0
::1 ::1 UH lo0
::ffff:0.0.0.0/96 ::1 UGRS lo0
2001:470:1f07:b80::/64 link#1 U em0
2001:470:1f07:b80:21b:21ff:fe51:ab2d link#1 UHS lo0
fe80::/10 ::1 UGRS lo0
fe80::%em0/64 link#1 U em0
fe80::21b:21ff:fe51:ab2d%em0 link#1 UHS lo0
fe80::%lo0/64 link#3 U lo0
fe80::1%lo0 link#3 UHS lo0
ff01:1::/32 fe80::21b:21ff:fe51:ab2d%em0 U em0
ff01:3::/32 ::1 U lo0
ff02::/16 ::1 UGRS lo0
ff02::%em0/32 fe80::21b:21ff:fe51:ab2d%em0 U em0
ff02::%lo0/32 ::1 U lo0
FreeBSD 8.1-STABLE
$ ping6 www.freebsd.org
PING6(56=40+8+8 bytes) 2001:470:1f07:b80:21b:21ff:fe51:ab2d --> 2001:4f8:fff6::21
16 bytes from 2001:4f8:fff6::21, icmp_seq=0 hlim=55 time=93.120 ms
16 bytes from 2001:4f8:fff6::21, icmp_seq=1 hlim=55 time=95.246 ms
16 bytes from 2001:4f8:fff6::21, icmp_seq=2 hlim=55 time=91.177 ms
^C
--- www.freebsd.org ping6 statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 91.177/93.181/95.246/1.662 ms
$ sudo tcpdump -ni em0 proto ipv6-icmp or ipv6
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em0, link-type EN10MB (Ethernet), capture size 96 bytes
00:08:06.248569 IP6 2001:470:1f07:b80:21b:21ff:fe51:ab2d > 2001:4f8:fff6::21: ICMP6, echo request, seq 0, length 16
00:08:06.339562 IP6 2001:4f8:fff6::21 > 2001:470:1f07:b80:21b:21ff:fe51:ab2d: ICMP6, echo reply, seq 0, length 16
00:08:07.249549 IP6 2001:470:1f07:b80:21b:21ff:fe51:ab2d > 2001:4f8:fff6::21: ICMP6, echo request, seq 1, length 16
00:08:07.342011 IP6 2001:4f8:fff6::21 > 2001:470:1f07:b80:21b:21ff:fe51:ab2d: ICMP6, echo reply, seq 1, length 16
so pings get out...
$ sudo pfctl -sa
pfctl: /dev/pf: No such file or directory
No rules
ping the gateway:
$ ping6 2001:470:1f07:b80::1
PING6(56=40+8+8 bytes) 2001:470:1f07:b80:21b:21ff:fe51:ab2d --> 2001:470:1f07:b80::1
16 bytes from 2001:470:1f07:b80::1, icmp_seq=0 hlim=64 time=0.575 ms
16 bytes from 2001:470:1f07:b80::1, icmp_seq=1 hlim=64 time=0.460 ms
16 bytes from 2001:470:1f07:b80::1, icmp_seq=2 hlim=64 time=0.487 ms
^C
--- 2001:470:1f07:b80::1 ping6 statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.460/0.507/0.575/0.049 ms
$ host www.freebsd.org
www.freebsd.org has address 69.147.83.33
www.freebsd.org has IPv6 address 2001:4f8:fff6::21
www.freebsd.org mail is handled by 0 .
$ fetch -6 http://www.freebsd.org/
nothing shows on tcpdump












It seems I was missing an important rule:
pass in on $int_if inet6 proto tcp flags S/SA keep state
where $int_if is the NIC to the internal LAN on the router