# pf on FreeBSD 8 is causing packet loss on connections over IPv6



## rmo (May 29, 2010)

I have a tunnel and a subnet from SixXS.net configured and running on a router. My FreeBSD machine is connected to this router and has statically assigned IP addresses:

from /etc/rc.conf

```
ipv6_enable="YES"
ipv6_defaultrouter="YES"
ipv6_ifconfig_fxp0="my:prefix::2 prefixlen 48"
ipv6_ifconfig_fxp0_alias0="my:prefix::3 prefixlen 48"
[...]
ipv6_ifconfig_fxp0_alias6="my:prefix::9 prefixlen 48"
ipv6_defaultrouter="my:prefix::1"
```

Everything works fine


```
# ping6 ipv6.google.com
PING6(56=40+8+8 bytes) my:prefix::2 --> 2a00:1450:8005::93
16 bytes from 2a00:1450:8005::93, icmp_seq=0 hlim=51 time=42.170 ms
16 bytes from 2a00:1450:8005::93, icmp_seq=1 hlim=51 time=38.779 ms
16 bytes from 2a00:1450:8005::93, icmp_seq=2 hlim=51 time=38.500 ms
[...]
--- ipv6.l.google.com ping6 statistics ---
21 packets transmitted, 21 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 36.356/40.098/52.244/4.282 ms
```

unless I enable pf which seems to be causing a lot of packet losses


```
# pfctl -e
No ALTQ support in kernel
ALTQ related functions disabled
pf enabled
# ping6 ipv6.google.com
PING6(56=40+8+8 bytes) my:prefix::2 --> 2a00:1450:8005::63
16 bytes from 2a00:1450:8005::63, icmp_seq=4 hlim=51 time=999.749 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=5 hlim=51 time=37.941 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=6 hlim=51 time=41.165 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=7 hlim=51 time=40.906 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=8 hlim=51 time=37.961 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=9 hlim=51 time=49.885 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=10 hlim=51 time=38.624 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=11 hlim=51 time=48.177 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=12 hlim=51 time=38.813 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=52 hlim=51 time=2001.474 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=53 hlim=51 time=1001.662 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=54 hlim=51 time=38.127 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=55 hlim=51 time=43.811 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=56 hlim=51 time=37.920 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=57 hlim=51 time=38.477 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=58 hlim=51 time=36.037 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=59 hlim=51 time=49.434 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=60 hlim=51 time=43.064 ms
16 bytes from 2a00:1450:8005::63, icmp_seq=61 hlim=51 time=46.355 ms
^C
--- ipv6.l.google.com ping6 statistics ---
83 packets transmitted, 19 packets received, 77.1% packet loss
round-trip min/avg/max/std-dev = 36.037/245.767/2001.474/507.273 ms
```

That, obviously, makes establishing and maintaining any connection rather difficult. 

/etc/pf.conf which I'm using 

```
table <soylan> { 192.168.13.0/24 } 
table <soylan6> { my:prefix::/48 } 

set skip on lo0

block in all
pass out quick all keep state

pass in quick inet from <soylan> to any
pass in quick inet6 from <soylan6> to any

pass in quick proto icmp6 from <soylan6>

pass in log quick proto { tcp udp } from { 79.98.145.34, 195.80.237.194 } to 192.168.13.4 port 53 
block return in quick proto { tcp udp } to 192.168.13.4 port 53
```

What may be the problem? How can I debug it? What additional information should I include? And, finally, how to fix it, except for turning pf off?


----------



## rmo (May 30, 2010)

It turns out you need to let at least some icmp packets through, fe
pass in quick inet6 proto ipv6-icmp from any to any icmp6-type {neighbradv,neighbrsol,routeradv}

http://lists.freebsd.org/pipermail/freebsd-doc/2007-May/012450.html


----------

