As some my deivce cannot turn off IPv6 and it also unstable when using it, so I try to filter all IPv6 packet for it, I successfully filter most IPv6 packet include ICMPv6 type 133/135 by drop all IPv6 (86dd) packet but that device still can receive RA and generate the IPv6 address.I also try to filter out multicast packet but I don’t see any ICMPv6 Type 134 packet.
What am I missing?
Nothing. What you want cannot be done.
Except when you split your LAN into two different networks, on one you announce IPv6 and on the other you don’t.
This second LAN can be a single port on your router. Just take it out of the bridge, put an IPv4 subnet on it, configure DHCP when required, and off you go.
I am trying to avoid setup another vlan as the switch that device connect to are not vlan aware, but as you said it seems can’t be done without separate them
Thanks
I use the MAC of the device in IPv6 RAW and block on ICMP 135 code 0.
133 and 135 works, the problem is I can’t block 134, actually I don’t see any 134 too but the device still generate Ipv6 Address
add action=drop chain=prerouting comment="Tablet IPv6 block" icmp-options=135:0 log-prefix=Nexus protocol=icmpv6 src-mac-address=XX:XX:0B:64:B5:C6
add action=drop chain=prerouting icmp-options=134:0 log-prefix=Tabletprotocol=icmpv6 src-mac-address=XX:XX:0B:64:B5:C6
add action=drop chain=prerouting icmp-options=133:0 log-prefix=Tabletprotocol=icmpv6 src-mac-address=XX:XX:0B:64:B5:C6
add action=drop chain=prerouting icmp-options=143:0 log-prefix=Tabletprotocol=icmpv6 src-mac-address=XX:XX:0B:64:B5:C6
Hahaha I see now that I have block 143 instead of 134 so I will have to change that. Despite it not correct it had 2 hits already from the tablet so that is a bit strange.
Update: maybe the 143 is not a mistake so I have added it back into the lines again.
Any luck yet?
Not yet, although I understand the reason behind it
I think I better just disable ipv6 until I replace all the dump switch to managed switch, redesign our network