Fix matching ICMPv6 mld-listener-query packets

[config/nftables.git] / nftables-workstation.nft

diff --git a/nftables-workstation.nft b/nftables-workstation.nft
index 3f1f446..fd227f5 100644 (file)
--- a/nftables-workstation.nft
+++ b/nftables-workstation.nft
@@ -75,7 +75,8 @@ table inet filter {
         } ip6 hoplimit 255 accept
 
         # Allow multicast listener discovery on link-local addresses.
-        ip6 nexthdr ipv6-icmp icmpv6 type {
+        # RFC2710 specifies that a Hop-by-Hop Options header is used.
+        hbh nexthdr ipv6-icmp icmpv6 type {
             mld-listener-query,
             mld-listener-report,
             mld-listener-reduction