From 7da1727603cf12b6e12f19c1b9c7638fb60ecfb3 Mon Sep 17 00:00:00 2001 From: Asep Haryana Date: Mon, 3 Aug 2026 04:06:32 +0700 Subject: [PATCH] fix(firewall): accept IPv6 MLD/ND multicast (ff02::1, ff02::2, ff02::fb) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Neighbor multicast to ff02::1 (MLDv2 reports from other hosts) was hitting the LOG+DROP tail — ~1800 FW6-DROP lines/6h in journald, i.e. ~5/min of pure log spam from ICMPv6 layer-2 discovery. Accept link-local multicast ranges before the logging rule. --- infra/firewall/firewall.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/infra/firewall/firewall.sh b/infra/firewall/firewall.sh index a649d04..bfc0ea0 100755 --- a/infra/firewall/firewall.sh +++ b/infra/firewall/firewall.sh @@ -66,7 +66,13 @@ ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT ip6tables -A INPUT -p tcp --dport 4013 -j ACCEPT +# ICMPv6/MLD: ping + neighbor discovery (NIC multicast ff02::1 = MLDv2 reports +# dari host lain; kena LOG+DROP tiap menit — 1800 baris/6h di journal). +# IPv6 layer-2 discovery WAJIB di-ACCEPT, bukan cuma dropped. ip6tables -A INPUT -p icmpv6 -j ACCEPT +ip6tables -A INPUT -d ff02::1 -j ACCEPT +ip6tables -A INPUT -d ff02::2 -j ACCEPT +ip6tables -A INPUT -d ff02::fb -j ACCEPT ip6tables -A INPUT -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "FW6-DROP " --log-level 4 ip6tables -A INPUT -j DROP