0
votes
1answer
81 views

Rule accepting input HTTP in ip6tables not enough to allow IPv6 requests

I am facing an IPv6 accessibility problem with my server. The server is IPv6-capable and is capable of contacting/being contacted by third-parties on IPv6 (ping6 and traceroute6 tested on my Debian ...
0
votes
0answers
34 views

ip6tables: how to handle periodically changing prefix? [migrated]

My ISP provides me with native IPv6 (unfortunately DS-Lite for v4) and I'm using SLAAC for the clients in my local network behind a broadband router. As I don't trust the router (which is configured ...
0
votes
2answers
115 views

iptables for ipv6 address port forwarding to localhost port

Say I want to redirect 2a00:1450:400c:c01::71 on Port 443 to localhost Port 12345. How to do that with Iptables? Update Okey, it's Weechat which running an SSL relay on a port >=1000. It can make ...
2
votes
1answer
176 views

How do I set up an IPv6 DMZ with iptables without a static allocation?

I have several networks which are on Comcast's residential network. I need to access those networks from a variety of environments, via an SSH proxy on one of the hosts. (As it happens I'm using ...
0
votes
2answers
56 views

How to I forward requests on a IPv6 port to a IPv4 host behind NAT?

I run a Xen Dom0 with 2 VMs NATted (other VMs are bridged, and are ok). This Dom0 has an IPv6 and IPv4 address. Requests to, for example port 25 are forwarded to a LAN address that one of the VMs ...
0
votes
1answer
101 views

iptables dual stack - ipv6 not working

I have problem with my iptables setup. I want to have completely dual stacked server so I use same rules for IPv4 and IPv6. However all IPv6 connections are just being dropped while IPv4 are working ...
0
votes
1answer
92 views

Attack from strange IP address, how to block?

Looking through the mail logs I've noticed a lot of these: Apr 7 11:33:25 s123456 pop3d: IMAP connect from @ [::ffff:192.96.206.9]checkmailpasswd: FAILED: web14p3 - short names not allowed from @ ...
0
votes
0answers
71 views

Couldn't load target `DNAT':No such file or directory

Trying to do some ipv6 nat and running into an error from ip6tables $ip6tables -t nat -N IPV6-BRIDGE $ip6tables -t nat -A PREROUTING -p all -d 2600:3c01::f03c:91ff:fe6e:2563 -j IPV6-BRIDGE $ip6tables ...
0
votes
1answer
108 views

ip6tables only allow packages to a certain ip-range

I am trying to configure ip6tables to only allow ssh connections to a specific range. In iptables the command would be: iptables -A OUTPUT -p tcp --dport 22 -m iprange --dst-range ...
0
votes
1answer
518 views

/etc/init.d/iptables-persistent start returns fail but seems to work

I am trying to activate iptables-persistent on an Ubunutu server. Config files are located in /etc/iptables/rules.v4 /etc/iptables/rules.v6 I have installed the iptables-persistent package. ...
4
votes
1answer
1k views

Why is iptables rejecting the second and subsequent fragments of an allowed packet?

I have two hosts which are attempting to set up an IPSec connection with each other. For this they have to communicate on UDP ports 500 and 4500, so I opened them in the firewalls on both ends (shown ...
1
vote
3answers
297 views

ipv6 on Ubuntu server - how do I secure?

On our Ubuntu server, ipv4 & ipv6 are enabled. We have taken these steps so far. Enabled iptables & ip6tables Copied the rules exactly from our iptables to ip6tables Do we need to make ...
5
votes
2answers
330 views

Linux: Block IPv6 for certain applications / hostnames

Problem and aim We don't get IPv6 from our ISP thus I have an IPv6 tunnel which works fine but is, of course, not very fast. And not really reliable. I like to have IPv6 available "just in case" but ...
2
votes
0answers
1k views

ip6tables port redirect with TPROXY on IPv6 only

Our server is IPv6 only connected and an applications listen to port 8080 at private network, but we need port 80 at public Internet. On purpose of testing, when opening the firewall for port 8080, ...
2
votes
1answer
271 views

Configuring ufw or iptables to allow only outbound traffic to the Internet from an internal IPv6 network

How do I configure ufw or iptables to allow only outbound traffic from an IPv6 network to the Internet? I have an office network with a traditional NAT setup for IPv4. I would like to add a PC ...
0
votes
1answer
246 views

Inject packet to a different NFQUEUE

I have an NFQUEUE, for IPv6 packets hooked to PREROUTING chain of mangle table in ip6tables. Once I receive a packet in user application, I modified the header. Infact, modified the header from IPv6 ...
-1
votes
3answers
2k views

SNAT in IP6Tables

Netfilter says they have support for SNAT and DNAT for ipv6. I look under the man pages of ip6tables and see that there is SNAT and DNAT listed. So my question is how do you make rules for them? I ...
-2
votes
1answer
123 views

Route connections via an IPv6 IP address? [closed]

I have a dedicated server with a big block of IPv6 IPs. I'd like to be able to use a randomized IPv6 IP within that block and run all outgoing connections through that single selected IP. I've ...
1
vote
1answer
380 views

Using u32 together with extension headers (how to jump over them?)

I'm trying to filter on some parts of the payload, for an IPv6 packet with extension headers (for instance Destination Options). ip6tables works fine with conditions like --proto udp or --dport 109, ...
1
vote
1answer
147 views

IP6tables blocks INPUT? can't connect with youtube API

I thought to have a simple ipv6 firewall, but it turned out to be hell. Somehow I really can't connect with any ipv6 from my machine unless I set INPUT Policy to ACCEPT. Below my current ip6tables ...
3
votes
4answers
2k views

Debian Squeeze ip6tables setup

I am setting up a firewall for ipv6 on Debian Squeeze. It is a webserver, so I think the only port that need to be open to the world for ipv6 is 80. This is what I have: *filter :INPUT DROP [0:0] ...
1
vote
3answers
624 views

Adding Facebook IPv6 to Centos, getting CurlException 7

I'm correctly get following error. After searching about this issue, correct me if i'm wrong, I believe that adding/configuring IPv6 should solve the problem. PHP Fatal error: Uncaught ...
0
votes
2answers
171 views

Iptables: Drop all incoming IP4 traffic on a port

I want to drop ALL the ipv4 traffic on a certain port and only allow ipv6 traffic with iptables. Is it possible? is so, how?
2
votes
1answer
933 views

ip6tables does not allow any traffic

I have been struggling getting ip6tables to work. It is for a CentOS 6 server running DirectAdmin, hence the ports. Could someone please tell me why it does not allow any traffic? Any input on this ...
9
votes
5answers
3k views

Managing parallel rules for ipv4 and ipv6 iptables?

We've recently started experimenting with IPv6, and one of the first issues we're having to contend with is dealing with a completely separate set of firewall (Linux iptables/ip6ables) rules for the ...
14
votes
3answers
444 views

What are the IPV6 reserved address spaces?

I'm converting my good old IPV4 based iptables firewall script and would like to substitute the CLASS A/B/C/D/E reserved address spaces to the ones found in IPV6. My goal is to deny any packets that ...
0
votes
2answers
394 views

ip6tables IPv6 address range comparison

I am using ip6tables to restrict connections to server. I use ip6tables with "-m iprange --src-range %s-%s" to specify the hosts that are allowed to connect. If I specify the range to 8000::0 - ...
0
votes
1answer
371 views

Bridging and routing IPv6 Router Advertisements

I have a bridge called "br01" in which the interfaces "eth1" and "eth0" are participating. There is a rule in the broute table of ebtables that drops RAs when they arrive in the interface eth1, so the ...
1
vote
3answers
1k views

ip6tables blocking output traffic

My OpenVZ VPS is blocking outbound IPv6 traffic, but correctly filtering inbound IPv6 traffic. Below is my ip6tables-restore script. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT ...
1
vote
2answers
889 views

How do you set up IPv6 alongside an IPv4-based NAT configuration?

I'm looking to route all my traffic from my IPv4 NAT to an IPv6 address I have. I googled around on the Internet for a good tutorial on this, and could not find one. Right now I have my network setup ...
3
votes
1answer
1k views

Linux IPv6 Transparent Proxy (but Linux doesn't support NAT on IPv6!?)

On Linux I can make a transparent proxy simply by adding a iptables -j REDIRECT command. To my surprise, I am needing to support IPv6. Simple enough right? iptables6 -j REDIRECT command not ...
2
votes
1answer
2k views

How to allow 6to4 through iptables firewall?

Im trying to allow 6to4 though my ipv4 firewall on Debian 6 (Squeeze) but without much luck, it seems most of the syntax used by other OS's isn't quite supported in Debian's iptables. I'v tried: (I ...
10
votes
2answers
6k views

Do I need seperate iptables rule for ipv6 address?

On my debian 5.0 server, I setup some iptables rules like below: ACCEPT tcp -- eee.fff.ggg.hhh aaa.bbb.ccc.ddd tcp dpt:80 DROP tcp -- 0.0.0.0/0 aaa.bbb.ccc.ddd ...