#
# Shorewall6 version 4 - AllowICMPs Action
#
# /usr/share/shorewall6/action.AllowICMPs
#
#	This action ACCEPTs needed ICMP types
#
###############################################################################
#TARGET	SOURCE		DEST	PROTO		DEST
#						PORT(S)	
COMMENT Needed ICMP types (RFC4890)

ACCEPT	-		-	ipv6-icmp	destination-unreachable
ACCEPT	-		-	ipv6-icmp	packet-too-big
ACCEPT	-		-	ipv6-icmp	time-exceeded
ACCEPT	-	-		ipv6-icmp	parameter-problem

# The following should have a ttl of 255 and must be allowed to transit a bridge
ACCEPT	-		-	ipv6-icmp	router-solicitation
ACCEPT	-		-	ipv6-icmp	router-advertisement
ACCEPT	-		-	ipv6-icmp	neighbour-solicitation
ACCEPT	-		-	ipv6-icmp	neighbour-advertisement
ACCEPT	-		-	ipv6-icmp	137	# Redirect
ACCEPT	-		-	ipv6-icmp	141	# Inverse neighbour discovery solicitation
ACCEPT	-		-	ipv6-icmp	142	# Inverse neighbour discovery advertisement

# The following should have a link local source address and must be allowed to transit a bridge
ACCEPT	fe80::/10	-	ipv6-icmp	130	# Listener query
ACCEPT	fe80::/10	-	ipv6-icmp	131	# Listener report
ACCEPT	fe80::/10	-	ipv6-icmp	132	# Listener done
ACCEPT	fe80::/10	-	ipv6-icmp	143	# Listener report v2

# The following should be received with a ttl of 255 and must be allowed to transit a bridge
ACCEPT	-		-	ipv6-icmp	148	# Certificate path solicitation
ACCEPT	-		-	ipv6-icmp	149	# Certificate path advertisement

# The following should have a link local source address and a ttl of 1 and must be allowed to transit abridge
ACCEPT	fe80::/10	-	ipv6-icmp	151	# Multicast router advertisement
ACCEPT	fe80::/10	-	ipv6-icmp	152	# Multicast router solicitation
ACCEPT	fe80::/10	-	ipv6-icmp	153	# Multicast router termination