3 ms·
Definitely. I suppose this was meant to say "outbound allow all / (inbound) deny all". Nitpick: please make sure ICMPv6 is allowed inbound though, else you'll
by lloeki 8y ago
Definitely.
I suppose this was meant to say "outbound allow all / (inbound) deny all".
Nitpick: please make sure ICMPv6 is allowed inbound though, else you'll get PMTU issues among other things.
- zrm 8y agoThis is true of IPv4 ICMP as well. Same PMTU issues, but many IPv4 implementations fallback to allowing in-path packet fragmentation by the routers (which IPv6 discontinued), which is less visible breakage but still inefficient/problematic. It's also slightly more complicated than "outbound allow, inbound deny" because you want to accept reply packets to the outbound ones, using something like the iptables "-m state --state related,established" match.