I have a fairly simplistic pfSense setup. IPv6 is provided through a Hurricane Electric tunnel.

Something on my home LAN is sending traffic from an odd-looking address, and so it's getting blocked, because my outgoing rules only allow traffic from the routed network defined by my tunnelbroker, within the subnet used by my instance of radvd.

Here's the traffic being blocked:

  • Interface LAN

  • Rule - default deny rule IPv6

  • Source - [my Hurricane IPv6 LAN prefix]:ffff:ffff:ffff:ffe2

  • Destination - various, including 2001:41d0:8:eab2::1 which has no DNS record and RIPE says is owned by someone in France

  • Protocol - UDP

  • Ports look dynamic on both source and destination (including 51413, 49001, 30295...)

I'm running radvd as a DHCP6 server on LAN, and that source address is outside of both the DHCP range and the LAN net range.

I can also confirm that the source address does not appear in the NDP table, so I don't know the culprit's MAC.

What is this traffic? What application would be causing it? Is it innocuous or should it continue to be blocked?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.