Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using ip6tables to restrict connections to server. I use ip6tables with "-m iprange --src-range %s-%s" to specify the hosts that are allowed to connect.

  1. If I specify the range to 8000::0 - ffff::ffff, the result looks like this.

    Chain ripp_0_0 (1 references)

    target prot opt source destination
    ACCEPT all ::/0 ::/0 source IP range 8000::-ffff::ffff

  2. If I specify the range to 0::0 - ffff::ffff, the result looks like this.

    Chain ripp_0_0 (1 references)

    target prot opt source destination
    ACCEPT all ::/0 ::/0 source IP range ::-ffff::ffff

My client has link-local address fe80::e91b:befe:97dc:9df5. For case 1, ip6tables work as expected, the connection is allowed. For case 2, it should also be allowed, but connection is rejected.

What is the algorithm used by ip6tables to compare addresses. Could someone please give some clue to pursue this issue.

Best regards.

share|improve this question
add comment

migrated from stackoverflow.com Aug 26 '11 at 3:05

This question came from our site for professional and enthusiast programmers.

2 Answers

Not sure about the ip6tables stuff, but ffff::ffff does not mean what you think it does. It expands to ffff:0000:0000:0000:0000:0000:0000:ffff. The range 0::0 to ffff::ffff will thus just fave zeroes in all the middle words I think. Try ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff if that is what you mean.

Or just use 8000::/1 and ::/0 if you want to say "half the address space" and "all the adress space". Understanding network masks is essential to your sanity when working with IPv6.

share|improve this answer
    
Thank you Jakob for clarifying the ffff::ffff problem. But it doesn't work after the command modified to "ip6tables -I INPUT -m iprange --src-range ::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff -j ACCEPT". Maybe there are other way, but the product I am working on uses some GUI to get the input that I cannot modify. And I don't understand why it doesn't work in this way. –  ning Aug 26 '11 at 6:29
add comment

::/128 is "unspecified address"; it's likely that netfilter is freaking out on that, as it's not a valid address. Try ::1 instead.

share|improve this answer
    
Hi womble, ::1 doesn't work either. The ranges that works has no rule to follow. The higher side is fixed to ffff::ffff. The lower side that works are 8000::0, fe00::0. The lower side that doesn't work are: 7e00::0, fe80::0. –  ning Aug 26 '11 at 11:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.