let me reiterate - do firewall rules extend to icmpv6?
The alternatives are equally bad - i can disallow all ping, then I can't ping from inside to the outside, or I can allow ping in general, but then the "Any" service does not seem to extend to pingv6.
With ipv4 this was not a problem, since that stuff was blocked by NAT anyway, but in ipv6 this becomes important.
We're discussing how to re-design the ICMP tab in the webadmin to reflect the more complex situation that we now have because of IPv6. It's not that easy to come up with a solution that satisfies all the different requirements our customers might have.
Should not the Any via any -> internal rule drop ping as well?
no, this behaviour is the same in V8 as it was in V7 and before The settings in the "icmp settings" are located in the "Auto" chains of iptable, and the "manual" packetfilter rules are located in the USR-chains, which are always applied AFTER the AUTO chains
Because having all ping or no ping is not really a nice alternative - I want to ping out but not ping in.
like in V7, you should be able to selectively allow ICMP from inside to outside but not vice versa by doing it like this: - do NOT check the "firewall forwards ping" check box - create a packetfilter rule for the ICMPs which you want to pass
