IPv6 firewall rules — address families, ICMPv6, and why "block all IPv6" is dangerous

IPv6 firewalling is not “IPv4 firewalling with longer addresses”. IPv4 and IPv6 are independent protocol families in PF. A rule that permits an IPv4 flow does not permit the equivalent IPv6 flow; the operator must write a parallel rule for IPv6, with the same semantics but the different address family. The most common production failure is to write excellent IPv4 rules and then leave IPv6 wide open — or block all IPv6, which breaks the protocol in subtle ways.

This lesson covers the address-family difference, the ICMPv6 types that must be permitted for IPv6 to function, and the production patterns for IPv6 rule sets.

Address families are independent

In PF and OPNsense, every firewall rule has an Address Family field: IPv4 only, IPv6 only, or IPv4+IPv6. The default for new rules in many configurations is IPv4 only. A rule that permits inbound SSH on IPv4 does not permit inbound SSH on IPv6 — IPv6 traffic is matched against IPv6 rules separately.

The implication: every IPv4 rule needs an IPv6 counterpart if the operator wants IPv6 to be governed by the same policy. The OPNsense “Address Family” option “IPv4+IPv6” lets a single rule match both families; this is the right tool for rules that should apply symmetrically.

$ pfctl -sr | grep -E 'pass|block' | head -10

pass in quick on igb1 inet proto tcp from any to (self) port = https flags S/SA keep state
pass in quick on igb1 inet6 proto tcp from any to (self) port = https flags S/SA keep state
block in quick on igb0 inet all
block in quick on igb0 inet6 all
pass in on igb1 inet from 192.168.1.0/24 to any keep state
pass in on igb1 inet6 from 2001:db8:abcd:e000::/64 to any keep state

ICMPv6 is not optional

ICMPv6 carries critical protocol functions that IPv4 ICMP does not:

ICMPv6 types 133-136 (SLAAC and Neighbor Discovery) are the protocol’s equivalent of ARP. Block them and IPv6 stops working — every host on the segment can no longer resolve its gateway’s MAC, can no longer self-configure, and can no longer detect duplicate addresses. The operator sees “IPv6 does not work on the LAN” and the firewall log shows nothing because the firewall silently dropped the ICMPv6 messages.

The minimum IPv6 rule set

For a typical OPNsense estate with IPv6 enabled on WAN and LAN, the minimum IPv6 rule set:

The LAN-side rules for RS/RA/NS/NA are critical. SLAAC and Neighbor Discovery use multicast on the LAN segment; if the LAN default-deny rule blocks ICMPv6 multicast, SLAAC breaks.

Writing the rules in OPNsense

In the OPNsense GUI, each rule has an “Address Family” field:

• IPv4: matches IPv4 traffic only.
• IPv6: matches IPv6 traffic only.
• IPv4+IPv6: matches both. Useful when the rule’s logic applies identically to both families.

For rules that govern SLAAC, Neighbor Discovery, and Router Advertisements, set the protocol to ICMPv6 and the type to the relevant type numbers. OPNsense exposes ICMPv6 type filtering under the rule’s “ICMP type” field.

For rules that permit specific ICMPv6 types, OPNsense exposes a checkbox list. The operator selects “Router Advertisement”, “Router Solicitation”, “Neighbor Solicitation”, “Neighbor Advertisement”, and the essential error types.

Mirror the IPv4 rule set

The right pattern for a production estate:

1. Build the IPv4 rule set first. Apply the same operational discipline to IPv4 that you would to any firewall.
2. Mirror every IPv4 rule to IPv6. For each IPv4 rule, create an IPv6 counterpart with the same source, destination, port, action, and direction. Use “IPv4+IPv6” where the rule’s semantics are identical.
3. Add the ICMPv6 rules. Permit RS, RA, NS, NA on the LAN; permit essential ICMPv6 error types on WAN.
4. Audit the rules. Firewall → Rules shows both families; review both. A rule that is in IPv4 only is a hole in IPv6.

The mirroring discipline produces two parallel rule sets. They are identical in intent and differ only in the addresses they reference. The operator who has to debug an incident looks at the same logic on both families.

Verifying IPv6 rules

The verification steps:

# Confirm the compiled ruleset
pfctl -sr | grep inet6

# Capture inbound IPv6 traffic and verify it matches the expected rules
tcpdump -nei igb0 'ip6 and tcp port 443'

# Test connectivity
ping6 2001:db8:abcd:e000::1           # LAN gateway
ping6 2001:4860:4860::8888            # External IPv6

The first command lists all IPv6 rules. The second captures actual IPv6 traffic on the WAN. The third tests both internal and external reachability.

Summary

• IPv4 and IPv6 are independent address families in PF; rules apply only to their declared family.
• ICMPv6 carries SLAAC, Neighbor Discovery, and PMTUD; blocking these breaks IPv6.
• The minimum IPv6 rule set permits RS/RA/NS/NA on the LAN and essential ICMPv6 errors inbound on WAN.
• “Block all IPv6” is not a security stance; IPv6 is enabled by default on most hosts and bypasses IPv4 rules entirely.
• Mirror the IPv4 rule set to IPv6; audit both regularly.