IPv6 for Solaris IP Filter
Beginning with the Solaris 10 6/06 release, support for IPv6 is available with
Solaris IP Filter. IPv6 packet filtering can filter based on the source/destination IPv6
address, pools containing IPv6 addresses, and IPv6 extension headers.
IPv6 is similar to IPv4 in many ways. However, header and packet
size differ between the two versions of IP, which is an important consideration for
IP Filter. IPv6 packets known as jumbograms contain a datagram longer than 65,535
bytes. Solaris IP Filter does not support IPv6 jumbograms. To learn more about
other IPv6 features, see Major Features of IPv6.
Note - For more information on jumbograms, refer to the document IPv6 Jumbograms, RFC 2675
from the Internet Engineering Task Force (IETF). [https://www.ietf.org/rfc/rfc2675.txt]
IP Filter tasks associated with IPv6 do not differ substantially from IPv4. The
most notable difference is the use of the -6 option with certain commands.
Both the ipf command and the ipfstat command include the -6 option
for use with IPv6 packet filtering. Use the -6 option with the ipf
command to load and flush IPv6 packet filtering rules. To display IPv6 statistics, use
the -6 option with the ipfstat command. The ipmon and ippool commands also
support IPv6, although there is no associated option for IPv6 support. The ipmon
command has been enhanced to accommodate the logging of IPv6 packets. The ippool
command supports the pools with IPv6 addresses. You can create pools of only
IPv4 or IPv6 addresses, or a pool containing both IPv4 and IPv6 addresses
within the same pool.
You can use the ipf6.conf file to create packet filtering rule sets for
IPv6. By default, the ipf6.conf configuration file is included in the /etc/ipf directory.
As with the other filtering configuration files, the ipf6.conf file loads automatically during the
boot process when it is stored in the /etc/ipf directory. You can
also create and store an IPv6 configuration file in another location and load
the file manually.
Note - Network Address Translation (NAT) does not support IPv6.
Once packet filtering rules for IPv6 have been set up, activate IPv6 packet
filtering capabilities by plumbing the inet6 version of the interface.
For more information on IPv6, see Chapter 3, Planning an IPv6 Addressing Scheme (Overview). For tasks associated with Solaris IP
Filter, see Chapter 26, Solaris IP Filter (Tasks).
