Technical data

4. Packages
PF6_INPUT_POLICY This variable sets the default strategy for all incoming packets for
the router (INPUT-Chain). Possible values are “REJECT” (default: rejects all pack-
ets), “DROP” (discards all packets without further notice) and “ACCEPT” (accepts all
packets). For a detailed description see the documentation of PF_INPUT_POLICY.
Default setting: PF6_INPUT_POLICY='REJECT'
PF6_INPUT_ACCEPT_DEF This variable activates the predefined rules for the INPUT-
chain of the IPv6-Firewall. Possible values are “yes” and “no”.
The default rules open the firewall for incoming ICMPv6 pings (one ping per second as
a limit) as well as for NDP packets (Neighbor Discovery Procotol) needed for stateless
auto-configuration of IPv6 networks. Connections from localhost and response packets
to locally initiated connections are also allowed. Finally the IPv4 firewall is adapted so
that for each tunnel IPv6-in-IPv4 encapsulated packets are accepted by the end of the
tunnel.
Default setting: PF6_INPUT_ACCEPT_DEF='yes'
PF6_INPUT_LOG This variable activates logging of all rejected incoming packets. Possible
values are “yes” and “no”. For a detailed description see documentation of PF_INPUT_LOG.
Default setting: PF6_INPUT_LOG='no'
PF6_INPUT_LOG_LIMIT This variable configures the log-limit of the INPUT-chains of the
IPv6-firewall to keep logfiles readable. For a detailed description see documentation of
PF_INPUT_LOG_LIMIT.
Default setting: PF6_INPUT_LOG_LIMIT='3/minute:5'
PF6_INPUT_REJ_LIMIT This variable sets the limit for rejection of incoming TCP-packets.
If such a packet exceeds this limit the packet will be dropped silently (DROP). For a
detailed description see the documentation of PF_INPUT_REJ_LIMIT.
Default setting: PF6_INPUT_REJ_LIMIT='1/second:5'
PF6_INPUT_UDP_REJ_LIMIT This variable sets the limit for rejection of incoming UDP-
packets. If such a packet exceeds this limit the packet will be dropped silently (DROP).
For a detailed description see the documentation of PF_INPUT_UDP_REJ_LIMIT.
Default setting: PF6_INPUT_UDP_REJ_LIMIT='1/second:5'
PF6_INPUT_ICMP_ECHO_REQ_LIMIT Defines how often the router should react to
ICMPv6-echo-queries. The frequency is written as ‘n/time period’ with bursts i.E.
’3/minute:5’ (in analogy to the limit-restriction). The packet will be ignored (DROP)
if the limit is reached. If empty the default setting ’1/second:5’ will be used, if set to
’none’ no limitations are accomplished.
Default setting: PF6_INPUT_ICMP_ECHO_REQ_LIMIT='1/second:5'
PF6_INPUT_ICMP_ECHO_REQ_SIZE Defines the maximum size of a revceived ICMPv6-
echo-request (in Bytes). Beside the data the packet-header size has to be considered. The
default value is 150 Bytes.
Default setting: PF6_INPUT_ICMP_ECHO_REQ_SIZE='150'
140