5

Im trying to allow 6to4 though my ipv4 firewall on Debian 6 (Squeeze) but without much luck, it seems most of the syntax used by other OS's isn't quite supported in Debian's iptables.

I'v tried: (I put these before the DROP all INPUT/OUTPUT lines)

$IPT -A INPUT -p ipv6 -j ACCEPT
$IPT -A OUTPUT -p ipv6 -j ACCEPT

Along with a few others but nothing seems to work.

1 Answer 1

10

When using 6to4, you do not transmit IPv6 packets. Instead, special IPv4 packets are wrapped around IPv6 payloads. These packets have IPv4 protocol 41, as defined by RFC 2473.

iptables -t filter -I INPUT -p 41 -j ACCEPT
iptables -t filter -I OUTPUT -p 41 -j ACCEPT
4
  • ^ the -t filter doesn't seem to be supported by Debian 6 "iptables: No chain/target/match by that name." iptables v1.4.8
    – Mint
    Mar 9, 2011 at 7:12
  • @Mint: No, the filter table always exists. I misspelled the chains INPUT and OUTPUT though; those should be upper-case.
    – ephemient
    Mar 9, 2011 at 8:02
  • aah I see, I'm new to iptables so it's not so obvious to me. Thanks for the fix.
    – Mint
    Mar 10, 2011 at 5:37
  • Just a small note: -p 41 is equal to -p ipv6. At least, this is what ip{,6}tables-save produces.
    – selurvedu
    Nov 1, 2017 at 5:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .