Technical data

4. Packages
PF6_FORWARD_LOG_LIMIT This variable configures the log limit for the FORWARD-
chain of the IPv6-firewall to keep it readable. For a detailed description see the docu-
mentation of PF_FORWARD_LOG_LIMIT.
Default setting: PF6_FORWARD_LOG_LIMIT='3/minute:5'
PF6_FORWARD_REJ_LIMIT This variable sets the limit for the rejection of forwarding
TCP-packets. If a packet exceeds this limit it will be dropped without further notice
(DROP). For a detailed description see the documentation of PF_FORWARD_REJ_LIMIT.
Default setting: PF6_FORWARD_REJ_LIMIT='1/second:5'
PF6_FORWARD_UDP_REJ_LIMIT This variable sets the limit for the rejection of forward-
ing UDP-packets. If a packet exceeds this limit it will be dropped without further notice
(DROP). For a detailed description see the documentation of PF_FORWARD_UDP_REJ_LIMIT.
Default setting: PF6_FORWARD_UDP_REJ_LIMIT='1/second:5'
PF6_FORWARD_N This variable contains the number of IPv6-firewall rules for packets to
be forwarded (FORWARD-chain). Two rules are activated as a default : the first denies
forwarding of all local samba packets to non-local nets and the second allows this for all
other local packets from the first defined IPv6-subnet.
If more local IPv6-dubnets are defined the last rule has to be cloned accordingly. See
also the configuration file.
Example: PF6_FORWARD_N='2'
PF6_FORWARD_x This variable specifies a rule for the FORWARD-chain of the IPv6-fire-
wall. For a detailed description see the documentation of PF_FORWARD_x.
Differences regarding the IPv4-firewall:
• IPV6_NET_x has to be used instead of IP_NET_x.
• IPV6_ROUTE_x has to be used instead of IP_ROUTE_x.
• IPv6-addresses must be enclosed in square brackets (including the network mask, if
present).
• All IPv6 address strings (including IP_NET_x etc.) must be enclosed in square brack-
ets if a port or a port range follows.
Examples:
PF6_FORWARD_1='tmpl:samba DROP'
PF6_FORWARD_2='IPV6_NET_1 ACCEPT'
PF6_FORWARD_x_COMMENT This variable holds a description or a comment for the
forward rule it belongs to.
Example: PF6_FORWARD_1_COMMENT='no␣samba␣traffic␣allowed'
PF6_OUTPUT_POLICY This variable sets the default strategy for outgoing packets from
the router (OUTPUT chain). Possible values are “REJECT” (standard, denies all pack-
ets), “DROP” (discards all packets without further notification) and “ACCEPT” (accepts
142