0

I have problem with my iptables setup. I want to have completely dual stacked server so I use same rules for IPv4 and IPv6. However all IPv6 connections are just being dropped while IPv4 are working without any problem.

Here are all files I use to populate firewall rules: here - First file is the script I run, second contains common (shared) rules for IPv4 and IPv6 and third and forth are files containing specific rules for IPv4 and IPv6.

I want to point out that everything works perfectly on IPv4.

Problem isn't just with the services like FTP but I can't even ping the server (tested from many computers on many different networks).

Just for you to be sure, this is output of command iptables -L -n -v:

Chain INPUT (policy DROP 511 packets, 79527 bytes)
 pkts bytes target     prot opt in     out     source               destination
 1765  739K ACCEPT     all  --  !eth0  *       0.0.0.0/0            0.0.0.0/0
43146 1980K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x10/0x10
  180 26305 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
  138  8300 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp multiport dports 20,21,25,80,443,465
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:50000:50500
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1194
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 0
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 4
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 11171 packets, 65M bytes)
 pkts bytes target     prot opt in     out     source               destination

and this is the output of command ip6tables -L -n -v:

Chain INPUT (policy DROP 32 packets, 3076 bytes)
 pkts bytes target     prot opt in     out     source               destination
    8   832 ACCEPT     all      !eth0  *       ::/0                 ::/0
    0     0 ACCEPT     tcp      *      *       ::/0                 ::/0                 tcpflags: 0x10/0x10
    0     0 ACCEPT     all      *      *       ::/0                 ::/0                 state RELATED,ESTABLISHED
    0     0 ACCEPT     tcp      *      *       ::/0                 ::/0                 tcp multiport dports 20,21,25,80,443,465
    0     0 ACCEPT     tcp      *      *       ::/0                 ::/0                 tcp dpts:50000:50500
    0     0 ACCEPT     udp      *      *       ::/0                 ::/0                 udp dpt:1194
    0     0 ACCEPT     icmpv6    *      *       ::/0                 ::/0                 ipv6-icmptype 129
    0     0 ACCEPT     icmpv6    *      *       ::/0                 ::/0                 ipv6-icmptype 1
    0     0 ACCEPT     icmpv6    *      *       ::/0                 ::/0                 ipv6-icmptype 128
    0     0 ACCEPT     icmpv6    *      *       ::/0                 ::/0                 ipv6-icmptype 3
    0     0 ACCEPT     icmpv6    *      *       ::/0                 ::/0                 ipv6-icmptype 4

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Ouput of iptables-save:

*filter
:INPUT DROP [93:13846]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4788:4752203]
-A INPUT ! -i eth0 -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp -m multiport --dports 20,21,25,80,443,465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 50000:50500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
COMMIT

Output of ip6tables-save:

*filter
:INPUT DROP [6:778]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT ! -i eth0 -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp -m multiport --dports 20,21,25,80,443,465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 50000:50500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 129 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 1 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 128 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 3 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 4 -j ACCEPT
COMMIT

If I try to ping the server over IPv6 (ping -6 2a02:2b88:2:1::2498:1) then I get Request timed out. If I try to ping it on the server (over SSH), then It ping's without any problem:

ping6 2a02:2b88:2:1::2498:1 --> 64 bytes from 2a02:2b88:2:1::2498:1: icmp_seq=1 ttl=64 time=0.034 ms

OR

ping6 localhost --> 64 bytes from localhost: icmp_seq=1 ttl=64 time=0.031 ms

I also forgot to mention that if I change whole INPUT chain to ACCEPT then everything works. Of course this is unfortunately not an option ...

6
  • Can you show us an example of ping6 not working? Can you clarify if that example is from a host on the same LAN? Do you have any evidence that your v6 routing is set up correctly? And can I beg you to edit the iptables output in your question to show ip{,6}tables -L -n -v, instead lf just -L? The additional information is vital, containing as it does things like interface-specificity on rules.
    – MadHatter
    Apr 25, 2014 at 10:11
  • Output from iptables-save and ip6tables-save may help debugging this problem.
    – kasperd
    Apr 25, 2014 at 10:13
  • 2
    I don't understand the list of ICMPv6 message types you are allowing. It seems that you took the ICMP (v4) message type numbers for ICMPv6, but the numbers are different for IPv6. E.g., ICMPv6 Echo Request is type 128, Echo Reply 129, etc. For a list see Wikipedia or the official IANA list.
    – Dubu
    Apr 25, 2014 at 12:10
  • Dubu: Thank you, I didn't know that. I compared the IPv4 and IPv6 ICMP codes and replaced them accordingly (I hope correctly). Unfortunately, problem is not solved. Please check changed rules. _____ kasperd: I don't think so, but I added the output so you can check it out. _____ @MadHatter I'm sorry that I forgot to mention that - if I change INPUT chain to ACCEPT then everything works as it should. I added ping example to the question. I also edited the output as you requested.
    – grongor
    Apr 25, 2014 at 15:18
  • Thanks for that, GRoNGoR. I'm very interested in your comment that if you change the ip6tables INPUT chain policy to ACCEPT, the ping6 starts working from the remote machine? It's an important result if you can confirm all that detail, as it indicates that some v6 routing is working.
    – MadHatter
    Apr 25, 2014 at 15:51

1 Answer 1

4

The problem was in the end really in the ICMP packets. To be precise, I didn't know that IPv6 doesn't use ARP and some other services anymore - it uses it's own mechanisms. To do so it needs many ICMPv6 packets to pass. After enabling everything works as expected.

I came to this solution by trying to just enable ALL ICMPv6 packets - everything worked. So I looked up some guides and figured out what ICMPv6 packets needs to be enabled.

I would like to recommend this rules set: https://gist.github.com/jirutka/3742890

I based my firewall settings on them and I will in the future from now on.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .