1
vote
1answer
57 views

Many 'Deny IPv6-ICMP reverse path check' alerts from multicast addresses on Cisco ASA

In an effort to prevent IP Source Address Spoofing (RFC 2827) I've enabled reverse path filtering (RPF) on my Cisco ASA 5505. The topology is aprox. like this. Each segment has its own IPv4 subnet ...
1
vote
1answer
50 views

How to convert proxy ARP setup to IPv6?

My company has a router/firewall deployed with the "common" Proxy ARP setup: it sits between some servers and the ISP gateway, and intercepts all the packets with proxy arp, so that it can apply both ...
0
votes
1answer
115 views

Does Fortigate 100A support IPv6? [closed]

Tried searching through the net but couldn't find any info since the product is already discontinued. Can anyone confirm if this particular product supports IPv6?
4
votes
2answers
122 views

ipv6 multiple addresses and firewall on remote machine

I have an ubuntu server (serverA) which has a couple of IPv6 addresses. One of these is based on it's MAC address, and is known to the network, the other one I presume ubuntu created as a 'private' ...
1
vote
2answers
86 views

IPv6 transition, firewall, router or “security switch” with firewall features?

It seems that I've lost the overview regarding IPv6 and all it's new features... We own a 3Com / HP OfficeConnect Gigabit VPN Firewall (3CREVF100-73) which has NO IPv6 support. Because we are ...
2
votes
1answer
228 views

Configuring ufw or iptables to allow only outbound traffic to the Internet from an internal IPv6 network

How do I configure ufw or iptables to allow only outbound traffic from an IPv6 network to the Internet? I have an office network with a traditional NAT setup for IPv4. I would like to add a PC ...
1
vote
2answers
383 views

Can a global IPv6 address be NAT'd to an internal IPv4 address at a firewall-level?

As an organisation we've just requested our first IPv6 allocation. At present we are a wholly IPv4 organisation with a global IPv4 address allocation configured on our edge router and used ...
0
votes
1answer
105 views

ipv6 port 445 does not accept the request from a global type address

I want to scan port 445 on my Windows server 2003, but my scanner only has one type ipv6 address which is global not link-local. When I do this, I find that I can't find port 445 open. But I use the ...
0
votes
1answer
266 views

Can these IPv4 and IPv6 firewall rules be hardened any further? [closed]

I am running Ubuntu 10.04. Here are the IPv4 firewall rules that I've been using now for a few months: *filter #Allow all loopback (lo0) traffic and drop all traffic to 127/8 #that doesn't use lo0 ...
0
votes
1answer
672 views

Using firewall in routed or transparent mode

For the last years we've been using a Sonicwall PRO 2040 firewall in a relatively small hosting environment. But we want to upgrade to a faster box which also support IPv6 and preferably we'd like to ...
2
votes
2answers
186 views

How to configure something like “Reflexive ACL” on OpenBSD?

My U-Verse modem has something called "Reflexive ACL" described as Reflexive ACL: When IPv6 is enabled, you can enable Reflexive Access Control Lists to deny inbound IPv6 traffic unless this ...
8
votes
5answers
3k views

Managing parallel rules for ipv4 and ipv6 iptables?

We've recently started experimenting with IPv6, and one of the first issues we're having to contend with is dealing with a completely separate set of firewall (Linux iptables/ip6ables) rules for the ...
32
votes
5answers
2k views

Will everyone having Globally Accessible IP's in IPv6 be kind of a security nightmare? [duplicate]

Possible Duplicate: Switch to IPv6 and get rid of NAT? Are you kidding? I'm thinking about the way that in IPv4 most of the time you have a single point to configure a firewall on, mainly ...
4
votes
1answer
92 views

Seeing strange IPv6 requests being dropped in our firewall

I'm seeing the following IPv6 addresses having requests dropped by our firewall. It doesn't seem to be anything too malicious, but there seems to be a strange pattern to them: ...
1
vote
2answers
404 views

Can I block all IPv6 traffic if I'm not using it/planning to use it?

I'm setting up a CentOS server and I have no intention to use IPv6 on it by now. Because of this, I have a few simple questions: Is there any problem in blocking all IPv6 traffic on this machine (in ...
1
vote
3answers
935 views

ip6tables blocking output traffic

My OpenVZ VPS is blocking outbound IPv6 traffic, but correctly filtering inbound IPv6 traffic. Below is my ip6tables-restore script. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT ...
6
votes
3answers
287 views

Is there already a recommended IPv6 Firewall setup?

I'd like to switch from private-IPv4-subnet-behind-NAT to IPv6, but of course I have no intention of exposing my users' workstations "unprotected" to the net. Some obvious points up-front: Allow ...
2
votes
2answers
869 views

Ip6tables script for a ipv6 router

I am using gogoc tunnel broker on my ubuntu pc for enabling ipv6. I want to use my Ubuntu pc as ipv6 router. I have enabled router mode in the gogoc client. I am using radvd for advertizing the router ...
0
votes
0answers
244 views

IPv6 and Windows Group Policy-based Firewall

So at work we're playing with using freenet6 to get an IPv6 tunnel up and running. That's working great and all, and I've got it set to advertise the route, and all of the test boxes now have ...
1
vote
1answer
662 views

MikroTik ipv6 Tunnel

I've got a MikroTik router set up with the latest stable OS on it, and I just set up an ipv6 tunnel with Hurricane Electric, but I'm having an odd issue with it. I can't ping anything until I first ...
3
votes
1answer
805 views

Provide IPv6 to network from OpenBSD firewall

I have an OpenBSD PF firewall that I have added a IPv6 tunnel to (using HE.net tunnelbroker). I can ping/traceroute IPv6 addresses from the firewall. Now I want to provide IPv6 services to the ...
2
votes
2answers
512 views

Remote management interface for managing ip6tables (or an alternative firewall)

I'm working with IPv6 and have run into an issue configuring ip6tables on our main router in order to control what can come into the network. A default DROP rule in the FORWARD section has worked well ...
9
votes
2answers
5k views

Do I need seperate iptables rule for ipv6 address?

On my debian 5.0 server, I setup some iptables rules like below: ACCEPT tcp -- eee.fff.ggg.hhh aaa.bbb.ccc.ddd tcp dpt:80 DROP tcp -- 0.0.0.0/0 aaa.bbb.ccc.ddd ...
1
vote
2answers
300 views

Security concerns of having IPv6 (tunneling) enabled in network computers

Are there any security concerns having IPv6 and Teredo tunneling enabled in Win Vista/7? AFAIK, using Teredo basically allows bypassing of the firewall, as the firewall cannot really filter the ...