1

What firewall settings should I add to my (Linux) 6to4 tunnel to prevent harmful IP address spoofing?

1
  • 6to4 is not a tunnel, it's a translation. Just saying. Dec 3, 2009 at 2:49

1 Answer 1

1

An answer you aren't going to like is, it is very hard to secure against spoofing when you cannot know what addresses are valid to accept.

6to4 takes an IPv6 address that is routed to a translator 6to4 box, which then routes it back to your IPv4 address. Other than checking to ensure that the incoming address is yours, there's not a lot you can do in terms of anti-spoof filtering.

However, once you get the packet in, you should still continue to apply standard firewall rules to it. It will still be a TCP stream or UDP packet once it hits your box, and a good place to start there would be whatever filtering you're doing on the IPv4 side.

2
  • I'm not worried about the destination address yet since I don't forward. I'd like to know which rules I should use to prevent the source address from looking like my machine's address, a link-local address, or some other ipv6 source address that obviously shouldn't come across the tunnel.
    – joeforker
    Dec 4, 2009 at 18:25
  • Otherwise my ipv6 firewall is nearly identical to my ipv4 firewall. Unfortunately Linux requires those to be separate.
    – joeforker
    Dec 4, 2009 at 18:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .