Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What firewall settings should I add to my (Linux) 6to4 tunnel to prevent harmful IP address spoofing?

share|improve this question
6to4 is not a tunnel, it's a translation. Just saying. – Michael Graff Dec 3 '09 at 2:49

An answer you aren't going to like is, it is very hard to secure against spoofing when you cannot know what addresses are valid to accept.

6to4 takes an IPv6 address that is routed to a translator 6to4 box, which then routes it back to your IPv4 address. Other than checking to ensure that the incoming address is yours, there's not a lot you can do in terms of anti-spoof filtering.

However, once you get the packet in, you should still continue to apply standard firewall rules to it. It will still be a TCP stream or UDP packet once it hits your box, and a good place to start there would be whatever filtering you're doing on the IPv4 side.

share|improve this answer
I'm not worried about the destination address yet since I don't forward. I'd like to know which rules I should use to prevent the source address from looking like my machine's address, a link-local address, or some other ipv6 source address that obviously shouldn't come across the tunnel. – joeforker Dec 4 '09 at 18:25
Otherwise my ipv6 firewall is nearly identical to my ipv4 firewall. Unfortunately Linux requires those to be separate. – joeforker Dec 4 '09 at 18:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.