Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What firewall settings should I add to my (Linux) 6to4 tunnel to prevent harmful IP address spoofing?

share|improve this question
    
6to4 is not a tunnel, it's a translation. Just saying. –  Michael Graff Dec 3 '09 at 2:49

1 Answer 1

An answer you aren't going to like is, it is very hard to secure against spoofing when you cannot know what addresses are valid to accept.

6to4 takes an IPv6 address that is routed to a translator 6to4 box, which then routes it back to your IPv4 address. Other than checking to ensure that the incoming address is yours, there's not a lot you can do in terms of anti-spoof filtering.

However, once you get the packet in, you should still continue to apply standard firewall rules to it. It will still be a TCP stream or UDP packet once it hits your box, and a good place to start there would be whatever filtering you're doing on the IPv4 side.

share|improve this answer
    
I'm not worried about the destination address yet since I don't forward. I'd like to know which rules I should use to prevent the source address from looking like my machine's address, a link-local address, or some other ipv6 source address that obviously shouldn't come across the tunnel. –  joeforker Dec 4 '09 at 18:25
    
Otherwise my ipv6 firewall is nearly identical to my ipv4 firewall. Unfortunately Linux requires those to be separate. –  joeforker Dec 4 '09 at 18:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.