0

I am using ip6tables to restrict connections to server. I use ip6tables with "-m iprange --src-range %s-%s" to specify the hosts that are allowed to connect.

  1. If I specify the range to 8000::0 - ffff::ffff, the result looks like this.

    Chain ripp_0_0 (1 references)

    target prot opt source destination
    ACCEPT all ::/0 ::/0 source IP range 8000::-ffff::ffff

  2. If I specify the range to 0::0 - ffff::ffff, the result looks like this.

    Chain ripp_0_0 (1 references)

    target prot opt source destination
    ACCEPT all ::/0 ::/0 source IP range ::-ffff::ffff

My client has link-local address fe80::e91b:befe:97dc:9df5. For case 1, ip6tables work as expected, the connection is allowed. For case 2, it should also be allowed, but connection is rejected.

What is the algorithm used by ip6tables to compare addresses. Could someone please give some clue to pursue this issue.

Best regards.

1
  • I know that was 10 years ago, but did you solve it? :-D
    – Houman
    Dec 1, 2021 at 18:32

2 Answers 2

1

Not sure about the ip6tables stuff, but ffff::ffff does not mean what you think it does. It expands to ffff:0000:0000:0000:0000:0000:0000:ffff. The range 0::0 to ffff::ffff will thus just fave zeroes in all the middle words I think. Try ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff if that is what you mean.

Or just use 8000::/1 and ::/0 if you want to say "half the address space" and "all the adress space". Understanding network masks is essential to your sanity when working with IPv6.

1
  • Thank you Jakob for clarifying the ffff::ffff problem. But it doesn't work after the command modified to "ip6tables -I INPUT -m iprange --src-range ::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff -j ACCEPT". Maybe there are other way, but the product I am working on uses some GUI to get the input that I cannot modify. And I don't understand why it doesn't work in this way.
    – ning
    Aug 26, 2011 at 6:29
1

::/128 is "unspecified address"; it's likely that netfilter is freaking out on that, as it's not a valid address. Try ::1 instead.

1
  • Hi womble, ::1 doesn't work either. The ranges that works has no rule to follow. The higher side is fixed to ffff::ffff. The lower side that works are 8000::0, fe00::0. The lower side that doesn't work are: 7e00::0, fe80::0.
    – ning
    Aug 26, 2011 at 11:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .