1

I have a static IPv4 and a static IPv6 address. Right now, my iptables look like:

*filter
:INPUT DROP [28:2168]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [551:134808]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 111.222.333.555/32 -i eth0 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 111.222.333.444/32 -i eth0 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 389 -j ACCEPT
-A INPUT -i eth0 -s 123.4.567.111/32 -p udp -m udp --dport 161 -j ACCEPT
-A INPUT -i eth0 -s 123.4.567.111/32 -p udp -m udp --dport 6969 -j ACCEPT
-A INPUT -i eth0 -s 123.4.567.111/32 -p icmp -j ACCEPT
-A OUTPUT -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT

I tried to use this for my IPv6 ip6tables, but my tries fail - I can't ping google anymore or connect via IPv6 from my workstation.

*filter
:INPUT DROP [28:2168]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [551:134808]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 389 -j ACCEPT
-A OUTPUT -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT

Right now, the machines with the IP addresses 111.222.333.555, 111.222.333.444 and 123.4.567.111 doesn't have IPv6 but I want to roll it out now.

When I change the :INPUT DROP and :FORWARD DROP both to ACCEPT, I can access the machine of course with ssh -6, ping6 and http/https. I use debian wheezy 7.0.2, kernel 3.2.0.

1 Answer 1

4

IPv6 is dependent on a variety of ICMPv6 packets to keep the network functioning. To enable Ping you need a rule like.

-A INPUT-p 58 --icmpv6-type 128 -j ACCEPT -m comment --comment "Ping"

This is a chain that accept the required ICMP types. It was extracted from a Shorewall6 generated firewall. It is accessed with a rule like:

-A INPUT -j AllowICMPs
-A AllowICMPs -p 58 --icmpv6-type 1 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 2 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 3 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 4 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 133 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 134 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 135 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 136 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 137 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 141 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 142 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 130 -s fe80::/10 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 131 -s fe80::/10 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 132 -s fe80::/10 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 143 -s fe80::/10 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 148 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 149 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 151 -s fe80::/10 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 152 -s fe80::/10 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 153 -s fe80::/10 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .