On 5 June 2017 at 15:16, Peter Poeschl <[email protected]> wrote: > Package: nftables > Version: 0.7-1 > Severity: important > Tags: ipv6 >
Hi Peter, thanks for your detailed report :-) it's really appreciated. > Dear Maintainer, > > * What led up to the situation? > > Tried to migrate my iptables/ip6tables based firewall to nftables. > Good to hear that! > > * What exactly did you do (or not do) that was effective (or > ineffective)? > > inet input and output chains have a > ip6 nexthdr ipv6-icmp counter accept > expression in the ruleset.nft config file > > > * What was the outcome of this action? > > ICMPv6 output frames are rejected, ICMPv6 input frames are dropped. > This breaks neighborhood discovery, ping6 gets no reply (the response frames > are not passed in the router). This is not a router configuration problem, > because switching to the iptables/ip6tables setup makes IPv6 work again. > > > * What outcome did you expect instead? > ICMPv6 frames should be accepted to make neighborhood discovery possible. > I just tested in my machine with 'ip6 nexthdr icmpv6' (icmpv6 and ipv6-icmp are the same) and it does work. This is likely a configuration issue rather than a bug, i.e, please check that your ruleset match the requirements of your environment and that the rest of your system configuration is working as expected. I'm closing this bug report now. Please, feel free to reopen if you still think that nftables is somehow broken. regards.
