MythEclipse/asepharyana-hub
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(firewall): accept IPv6 MLD/ND multicast (ff02::1, ff02::2, ff02::fb)

Browse Source 
Neighbor multicast to ff02::1 (MLDv2 reports from other hosts) was
hitting the LOG+DROP tail — ~1800 FW6-DROP lines/6h in journald,
i.e. ~5/min of pure log spam from ICMPv6 layer-2 discovery. Accept
link-local multicast ranges before the logging rule.
This commit is contained in:
Asep Haryana
2026-08-03 04:06:32 +07:00
parent 9e9fd229d0
commit 7da1727603
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/firewall/firewall.sh
+6
View File
@@ -66,7 +66,13 @@ ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 4013 -j ACCEPT
# ICMPv6/MLD: ping + neighbor discovery (NIC multicast ff02::1 = MLDv2 reports
# dari host lain; kena LOG+DROP tiap menit — 1800 baris/6h di journal).
# IPv6 layer-2 discovery WAJIB di-ACCEPT, bukan cuma dropped.
ip6tables -A INPUT -p icmpv6 -j ACCEPT
ip6tables -A INPUT -d ff02::1 -j ACCEPT
ip6tables -A INPUT -d ff02::2 -j ACCEPT
ip6tables -A INPUT -d ff02::fb -j ACCEPT
ip6tables -A INPUT -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "FW6-DROP " --log-level 4
ip6tables -A INPUT -j DROP