diff options
| author | David Lönnhager <david.l@mullvad.net> | 2021-10-11 10:06:35 +0200 |
|---|---|---|
| committer | David Lönnhager <david.l@mullvad.net> | 2021-10-11 10:06:35 +0200 |
| commit | 9c3b434bd4a087a15a98e67d270efb3f50fddb20 (patch) | |
| tree | ee91bc405287a57b83c44eebb911524e986ea3f6 /docs/security.md | |
| parent | 6aa2b5ce21d3b3f740ed241b5f659b022e4f9790 (diff) | |
| parent | 2d31b521c6807f3f71562bda1963872f11797295 (diff) | |
| download | mullvadvpn-9c3b434bd4a087a15a98e67d270efb3f50fddb20.tar.xz mullvadvpn-9c3b434bd4a087a15a98e67d270efb3f50fddb20.zip | |
Merge branch 'win-fix-fw-ndp'
Diffstat (limited to 'docs/security.md')
| -rw-r--r-- | docs/security.md | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/docs/security.md b/docs/security.md index c34a7d73a0..2f0b09e31c 100644 --- a/docs/security.md +++ b/docs/security.md @@ -64,10 +64,14 @@ The following network traffic is allowed or blocked independent of state: server) * Incoming UDP from `[fe80::]/10:547` to `[fe80::]/10:546` (server to client) -1. Router solicitation, advertisement and redirects (subset of NDP) is always allowed: +1. A subset of NDP is allowed: * Outgoing to `ff02::2`, but only ICMPv6 with type 133 and code 0 (Router solicitation) - * Incoming from `[fe80::]/10`, but only ICMPv6 type 134 and code 0 (Router advertisement) - * Incoming from `[fe80::]/10`, but only ICMPv6 type 137 and code 0 (Redirect) + * Incoming from `fe80::/10`, but only ICMPv6 type 134 and code 0 (Router advertisement) + * Incoming from `fe80::/10`, but only ICMPv6 type 137 and code 0 (Redirect) + * Outgoing to `ff02::1:ff00:0/104` and `fe80::/10`, but only ICMPv6 with type 135 and code 0 (Neighbor solicitation). + * Incoming from `fe80::/10`, but only ICMPv6 with type 135 and code 0 (Neighbor solicitation). + * Outgoing to `fe80::/10`, but only ICMPv6 with type 136 and code 0 (Neighbor advertisement). + * Incoming from `*`, but only ICMPv6 with type 136 and code 0 (Neighbor advertisement). 1. If the "Allow LAN" setting is enabled, the following is also allowed: * Outgoing to, and incoming from, any IP in an unroutable network, that means: @@ -95,11 +99,6 @@ The following network traffic is allowed or blocked independent of state: On Linux, any situation that permits incoming or outgoing traffic also allows that traffic to be forwarded. All other forward traffic is rejected. -#### macOS deviations - -* The app does not look at ICMPv6 type and code headers. So all ICMPv6 is allowed between the - specified IP networks. - ### Disconnected This is the default state that the `mullvad-daemon` starts in when the device boots, unless |