Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm struggling to allow IPv6 connections on my FreeBSD 10 server.
I have a working IPv6 connection. But IPFW blocks all the IPv6 traffic.

#!/bin/sh
#
# flush existing rules
ipfw -q flush
# allow established connections
ipfw -q add 1 check-state
# allow loopback traffic
ipfw -q add 2 allow all from any to any via lo0
# allow previously established TCP connections
ipfw -q add 3 allow tcp from any to any established
#
# public services inbound: 22/tcp (SSH) and 80/tcp (HTTP)
ipfw -q add 60100 set 1 allow tcp from any to me 22 in setup keep-state
ipfw -q add 60101 set 1 allow tcp from any to me 80 in setup keep-state
#
# allow all traffic going out
ipfw -q add 200 set 1 allow udp from me to any out keep-state
ipfw -q add 201 set 1 allow tcp from me to any out setup keep-state
#
# allow common ICMP types in and out
ipfw -q add 400 set 1 allow icmp from me to any icmptypes 0,3,8,11,12,13,14
ipfw -q add 401 set 1 allow icmp from any to me icmptypes 0,3,8,11,12,13,14
#
# allow tcp connections out on backup interface
ipfw -q add 500 set 1 allow tcp from any to any out via re1 setup keep-state
#
# deny everything else coming in
#ipfw -q add 999 set 1 deny all from any to any

How can I enable IPv6 for http and imcp in this setup? Thanks in advance!

share|improve this question
1  
Why do you believe it is the firewall blocking traffic? – Michael Hampton Jun 13 '14 at 17:21
    
Because if I set it to allow all traffic (or disable it), I have an internet connection... $ sudo service ipfw stop net.inet.ip.fw.enable: 1 -> 0 net.inet6.ip6.fw.enable: 1 -> 0 $ ping6 ipv6.google.com PING6(56=40+8+8 bytes) 2001:470:1f15:7a3:1:1:1:50 --> 2a00:1450:4009:804::1002 16 bytes from 2a00:1450:4009:804::1002, icmp_seq=0 hlim=56 time=14.261 ms – MathiasB Jun 13 '14 at 17:41

Your IPv6 traffic does not match any of the rules, therefore matches the last rule, which is an explicit deny rule.

First you need to make sure IPFW does process IPv6 traffic. This is done by enabling it using sysctl:

sysctl net.inet.ip.fw.enable=1

IPFW supports various IPv6 specific keywords, like me6 instead of me. So you may want to add rules like the following:

ipfw -q add 60102 set 1 allow tcp from any to me6 80 in setup keep-state
ipfw -q add 60103 set 1 allow tcp from any to me6 22 in setup keep-state

For more information on this topic, you may want to consult RULE FORMAT section on ipfw(8) man page: https://www.freebsd.org/cgi/man.cgi?query=ipfw#RULE_FORMAT

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.