Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have been struggling getting ip6tables to work. It is for a CentOS 6 server running DirectAdmin, hence the ports.
Could someone please tell me why it does not allow any traffic?

Any input on this is highly appreciated, as I am stuck at this for days now.

/sbin/ip6tables -F
/sbin/ip6tables -t mangle -F
/sbin/ip6tables -A INPUT -i lo -j ACCEPT
/sbin/ip6tables -A OUTPUT -o lo -j ACCEPT
/sbin/ip6tables -P INPUT DROP
/sbin/ip6tables -P OUTPUT ACCEPT
/sbin/ip6tables -P FORWARD DROP
/sbin/ip6tables -t mangle -P PREROUTING ACCEPT
/sbin/ip6tables -t mangle -P OUTPUT ACCEPT
/sbin/ip6tables -X
/sbin/ip6tables -t mangle -X
/sbin/ip6tables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
/sbin/ip6tables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
/sbin/ip6tables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
/sbin/ip6tables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
/sbin/ip6tables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
/sbin/ip6tables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
/sbin/ip6tables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
/sbin/ip6tables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -m state --state INVALID -j DROP
/sbin/ip6tables -A INPUT -i eth0 -s aaaa:bbbb:cccc:dddd:: -j DROP
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 80 -m connlimit --connlimit-above 10 -j DROP
/sbin/ip6tables -A INPUT -i eth0 -s 0:0:0:0:0:0:0:1 -j DROP
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 20 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 21 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 35000:35999 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 25 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 587 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 53 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p udp -d aaaa:bbbb:cccc:dddd:: --dport 53 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 80 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 443 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 110 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 995 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 143 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 993 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 2222 -m state --state NEW -j ACCEPT
share|improve this question

1 Answer 1

up vote 3 down vote accepted

Try allowing icmpv6. (for testing, just add "ip6tables -I INPUT -p icmpv6 -j ACCEPT").

In IPv6 you really need alot of ICMPv6.

Here is the rfc.

share|improve this answer
    
Thanks a bunch, that solved the issue. I have now added it like: /sbin/ip6tables -A INPUT -p icmpv6 -j ACCEPT under /sbin/ip6tables -A OUTPUT -o lo -j ACCEPT Is that the best way of doing so? –  Xen Jun 5 '12 at 15:16
    
It will work with that, but to be secure, you should limit pings, etc. The rfc has an appendix (b) at the end, with commented ip6tables example rules, which you should review. –  mulaz Jun 5 '12 at 15:20
    
Enlighten me please, do you mean filtering by type like --icmpv6-type echo-reply? –  Xen Jun 5 '12 at 15:33
1  
This is just one example. You need to let all neighbour discovery packets, router advertisments, packet-too-big, exceeded ttls, etc. You can leave it at allow-all (-A input -p icmpv6 -j ACCEPT), and it will work. If you wish to limit things, then you should read the rfc, what you can limit, and what not, and depending on your network size and equipment, what the limits are. If you don't have ipv6-enabled switches, or even dumb-switches, you will get alot of multicast icmps 'broadcasted', and the limits will need to be alot higher. It all depends on your needs and enviroment. –  mulaz Jun 5 '12 at 15:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.