3

I currently have the following:

ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 1 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 2 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 3 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 4 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 128 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 129 -j ACCEPT

For ICMPv6 type 3, I would like to only accept code 0.

For ICMPv6 type 4, I would like to only accept codes 1 and 2.

This is based on RFC 4890.

1
  • "This is based on RFC 4890." You are only wanting to allow that which should not be dropped. What about "Traffic That Normally Should Not Be Dropped," such as Type 3 Code 1 and Type 4 Code 0? Normally, you would not drop any code in Types 1, 2, 3, 4.
    – Ron Maupin
    Aug 10, 2020 at 15:47

1 Answer 1

5

The man page for iptables-extensions(8) says:

   icmp6 (IPv6-specific)
       This extension can be used if  `--protocol  ipv6-icmp'  or  `--protocol
       icmpv6' is specified. It provides the following option:

       [!] --icmpv6-type type[/code]|typename
              This  allows  specification  of  the ICMPv6 type, which can be a
              numeric ICMPv6 type, type and code, or one of  the  ICMPv6  type
              names shown by the command
               ip6tables -p ipv6-icmp -h
1
  • So is it like ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 3[0] -j ACCEPT or ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 3[/0] -j ACCEPT or even ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 3/0 -j ACCEPT Thanks
    – Houman
    Nov 28, 2021 at 13:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .