I have a static IPv4 and a static IPv6 address. Right now, my iptables look like:
*filter
:INPUT DROP [28:2168]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [551:134808]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 111.222.333.555/32 -i eth0 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 111.222.333.444/32 -i eth0 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 389 -j ACCEPT
-A INPUT -i eth0 -s 123.4.567.111/32 -p udp -m udp --dport 161 -j ACCEPT
-A INPUT -i eth0 -s 123.4.567.111/32 -p udp -m udp --dport 6969 -j ACCEPT
-A INPUT -i eth0 -s 123.4.567.111/32 -p icmp -j ACCEPT
-A OUTPUT -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
I tried to use this for my IPv6 ip6tables, but my tries fail - I can't ping google anymore or connect via IPv6 from my workstation.
*filter
:INPUT DROP [28:2168]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [551:134808]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 389 -j ACCEPT
-A OUTPUT -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
Right now, the machines with the IP addresses 111.222.333.555, 111.222.333.444 and 123.4.567.111 doesn't have IPv6 but I want to roll it out now.
When I change the :INPUT DROP and :FORWARD DROP both to ACCEPT, I can access the machine of course with ssh -6, ping6 and http/https. I use debian wheezy 7.0.2, kernel 3.2.0.