Technical data

4. Packages
all packages). For a more detailed description see the documentation of the Variable
PF_OUTPUT_POLICY.
Default setting: PF6_OUTPUT_POLICY='REJECT'
PF6_OUTPUT_ACCEPT_DEF This variable enables the default rules for the OUTPUT
chain of the IPv6 firewall. Possible values are “yes” or “no”. Currently, there are no
preset rules.
Default setting: PF6_OUTPUT_ACCEPT_DEF='yes'
PF6_OUTPUT_LOG This variable enables logging of all rejected outgoing packets. Possible
values are “yes” or “no”. For a more detailed description see the documentation of
variable PF_OUTPUT_LOG.
Default setting: PF6_OUTPUT_LOG='no'
PF6_OUTPUT_LOG_LIMIT This variable configures the log limit for the OUTPUT chain
of the IPv6 firewall, to keep the log file readable. For a more detailed description see the
documentation of variable PF_OUTPUT_LOG_LIMIT.
Default setting: PF6_OUTPUT_LOG_LIMIT='3/minute:5'
PF6_OUTPUT_REJ_LIMIT This variable configures the limit for the rejection of outgoing
TCP packets. If a packet exceeds this limit the packet is discarded quietly (DROP). For
a more detailed description see the documentation of variable PF_OUTPUT_REJ_LIMIT.
Default setting: PF6_OUTPUT_REJ_LIMIT='1/second:5'
PF6_OUTPUT_UDP_REJ_LIMIT This variable configures the limit for the rejection of
outgoing UDP packets. If a packet exceeds this limit the packet is discarded quietly
(DROP). For a more detailed description see the documentation of variable PF_OUTPUT_UDP_REJ_LIMIT.
Default setting: PF6_OUTPUT_UDP_REJ_LIMIT='1/second:5'
PF6_OUTPUT_N This variable contains the number of IPv6 firewall rules for incoming
packets (OUTPUT chain). By default, two rules are activated: the first allows all local
hosts to access the router via so-called Link-level addresses and the second allows router
access for hosts from the first defined IPv6 subnet.
If several local IPv6 subnets are defined, the second rule must be added repeatedly. See
the configuration file.
Example: PF6_OUTPUT_N='1'
PF6_OUTPUT_x This variable specifies a rule for the OUTPUT chain of the IPv6 Firewall.
For a more detailed description, see the documentation of the variable PF_OUTPUT_x.
Differences from IPv4 firewall:
• IPV6_NET_x has to be used instead of IP_NET_x.
• IPV6_ROUTE_x has to be used instead of IP_ROUTE_x.
• IPv6 addresses must be enclosed in square brackets (including the network mask, if
present).
143