--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -1535,6 +1535,9 @@
 			case IPV6_FW_DEL:
 			case IPV6_FW_FLUSH:
 			case IPV6_FW_ZERO:
+				/* firewall configuration requires privilege */
+				if (!privileged)
+					return (EPERM);
 			    {
 				struct mbuf *m;
 				struct mbuf **mp = &m;
@@ -1758,6 +1761,9 @@
 				break;
 
 			case IPV6_FW_GET:
+				/* firewall policy disclosure requires privilege */
+				if (!privileged)
+					return (EPERM);
 			  {
 				struct mbuf *m;
 				struct mbuf **mp = &m;