IP Filter

The ip_proto filter restricts traffic based on the IP protocol number. For IPv4, this corresponds to the Protocol field(RFC 791 3.1). For IPv6, it corresponds to the first upper-layer protocol identified after processing supported extension headers(RFC 8200 4).

The following protocol numbers are supported:

ip_proto { 1, 6, 17, 47, 58 }

which correspond to: ICMP (1), TCP (6), UDP (17), GRE (47), ICMPv6 (58).

If the ip_proto filter is not specified, the default behavior is equivalent to:

ip_proto { 1, 6, 17, 58 }

Traffic containing unsupported IP header features is considered anomalous and filtered.

Supported IPv6 extension headers:

• Hop-by-Hop Options (0)
• Routing (43)
• Authentication Header (AH, 51)
• Destination Options (60)
• Mobility Header (135)

IPv6 extension headers are processed sequentially until the first upper-layer protocol is reached (RFC 8200, Section 4).

IP features not supported:

• Encapsulating Security Payload (ESP, 50)
• IPv4 fragmentation
• IPv6 Fragment Header (44)

No fragment reassembly is performed.