From 2ec19a64cc2d4e5dcf0c85bc855f12a1a6576e32 Mon Sep 17 00:00:00 2001 From: David Wronek Date: Sun, 7 Dec 2025 21:37:36 +0100 Subject: [PATCH] nixos/firewall-nftables: fix multicast ping We can currently observe that pinging the multicast IPv6 address ff02::1 does not work as expected. This is because conntrack is marking the ICMPv6 replies as invalid and thus is dropping them. This can behaviour can be seen with these commands: 1. Get handle of the rule above the conntrack rule: ``` nft -a list ruleset inet ``` 2. Insert a rule to log all packets marked as invalid by conntrack: ``` nft insert rule inet nixos-fw \ input position ct state invalid \ log prefix \"ct invalid: \" ``` 3. Starting pinging ff02::1 and observe dmesg This change adds a rule to allow all ICMPv6 echo replies (type 129) before the conntrack rule starts taking action. Signed-off-by: David Wronek --- nixos/modules/services/networking/firewall-nftables.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nixos/modules/services/networking/firewall-nftables.nix b/nixos/modules/services/networking/firewall-nftables.nix index a22fc29d35ff..093160e78dbf 100644 --- a/nixos/modules/services/networking/firewall-nftables.nix +++ b/nixos/modules/services/networking/firewall-nftables.nix @@ -117,6 +117,10 @@ in ifaceSet != "" ) ''iifname { ${ifaceSet} } accept comment "trusted interfaces"''} + # Multicast ICMPv6 echo replies get marked as invalid by conntrack. + # Accept them before conntrack to avoid dropped replies. + icmpv6 type echo-reply accept + # Some ICMPv6 types like NDP is untracked ct state vmap { invalid : drop,