# Filtering IPv6 Router Advertisements: WHAT!?

## wswartzendruber

I'm told that despite router advertisements being ICMPv6, I can't use ip6tables to filter them.  "Packets don't pass through the CPU unless they jump interfaces" is what I'm told.

I'm having a very hard time believing this.

----------

## massimo

Have a look at [1]. Nevertheless, you will not be able to prevent any packet from entering your interface physically (unless you cut the cable or filter it at some other point in your network).

[1] RFC4890

----------

## maxime1986

you can't filter then but at least you can specify if you want to accept it :

sysctl net.ipv6.conf.all.accept_ra

----------

## pa4wdh

You can absolutely filter them (i know for sure because i had problems because i blocked them  :Smile:  ).

Any packet entering or leaving a linux system passes the CPU (maybe with an exception for special hardware, but i guess thats not the case).

Maybe the one who told you this is confused with IPv4's ARP, because that's not IP but an ARP packet directly in an ethernet frame you can't filter it with iptables.

----------

## hayalci

 *pa4wdh wrote:*   

> 
> 
> Any packet entering or leaving a linux system passes the CPU (maybe with an exception for special hardware, but i guess thats not the case).
> 
> 

 

But that does not mean you can block anything with iptables. e.g. DHCP still works even if you block all traffic with iptables.

----------

## pa4wdh

As far as i know from experience building my own set of firewall rules on my router (IPv4 and IPv6, doing routing, DHCP, DNS, HTTP, OpenVPN, FTP, SSH), you can block really anything as long as it's carried on IP, so the only exception would be ARP in case of IPv4. Since DHCP is just using UDP ports 67 and 68 i see no reason why you wouldn't be able to block it.

----------

## hayalci

DHCP still works because it taps into the network interface and takes DHCP packets from there. Even if you block it with iptables rules, so that the packet is dropped, the DHCP client(/server) will still get what it needs.

----------

## RNHavens

What about Ebtables to filter at layer two?  I've never looked into the above topics, but I would think that Ebtables would stop all of them.

----------

