2

With IPv4, you used to be able to give a host a static local IP address on the LAN, and use a firewall rule on the firewall/router to forward a port on the (possibly dynamic) Internet-facing IP used by the network to a port on tat particular host, using the host's static LAN IPv4 address as a stable way to identify the host in the firewall rule.

But with IPv6, every host is using real routable Internet IPs, so the incoming traffic for the host will already be addressed to it, and there's no need for NAT. But you still need to be able to write a firewall rule to say that inbound traffic to one particular host and port should be allowed, while traffic to other hosts or ports is blocked.

But if the prefix under which the network assigns IPv6 addresses is dynamic, how would you refer to a particular host in a firewall rule to allow traffic to it? You can't just allow traffic to its IPv6 address, because next week it will have an IPv6 address with a different prefix, because the ISP will have assigned the network a different prefix.

How do you then actually configure a firewall to allow inbound traffic to that host on some port? In ip6tables it looks like there's a --dest option to match by destination, but that only seems to let you put in an entire address and not e.g. a suffix of the address which you can ensure is kept static for a host. From the man page:

       [!] -s, --source address[/mask][,...]
              Source  specification.  Address can be either a network name, a
              hostname, a network IP address (with /mask), or a plain IP  ad‐
              dress. Hostnames will be resolved once only, before the rule is
              submitted to the kernel.  Please note that specifying any  name
              to  be resolved with a remote query such as DNS is a really bad
              idea.  The mask can be either an ipv4 network mask  (for  ipta‐
              bles)  or  a  plain number, specifying the number of 1's at the
              left side of the network mask.  Thus, an iptables mask of 24 is
              equivalent to 255.255.255.0.  A "!" argument before the address
              specification inverts the sense of the address. The flag  --src
              is  an alias for this option.  Multiple addresses can be speci‐
              fied, but this will expand to multiple rules (when adding  with
              -A), or will cause multiple rules to be deleted (with -D).

       [!] -d, --destination address[/mask][,...]
              Destination  specification.   See  the  description  of  the -s
              (source) flag for a detailed description of  the  syntax.   The
              flag --dst is an alias for this option.

Is there a way to handle this with ip6tables? Is there some other layer over ip6tables that is supposed to generate rules that change as the network is renumbered, that everyone is actually using? Is there some kind of ip6tables plugin that can let me match traffic that will go to a particular host even if the network number changes? Do other OS firewalls handle this differently?

5
  • "But if the prefix under which the network assigns IPv6 addresses is dynamic, how would you refer to a particular host in a firewall rule to allow traffic to it?" A business ISP connection does not do that. Only residential Internet connections are made that way because the residential contract prohibits serving to the Internet. You simply need to get a commercial Internet connection.
    – Ron Maupin
    Dec 23, 2022 at 22:41
  • @RonMaupin It wouldn't make any sense to need a commercial Internet connection with a static IP in order to open a hole in a firewall for, say, a multiplayer video game.
    – interfect
    Dec 30, 2022 at 2:59
  • Then you are asking on the wrong SE site. Server Fault is for business networking. You ask about residential networking on Super User].
    – Ron Maupin
    Dec 30, 2022 at 3:21
  • @RonMaupin I think this is the right SE site; iptables and ip6tables both seem more commonly discussed here than on SU (they aren't "consumer workstations or networking"). DHCP and DHCPv6-PD conversely aren't exclusively consumer-only technologies. Comcast sells static IPv6 (and IPv4) addresses as an add-on to their business Internet product: forums.businesshelp.comcast.com/conversations/ipv6/…, and if you don't buy that, they can change the prefix on you.
    – interfect
    Jan 2, 2023 at 21:35
  • Guide for IPv6 router using Openwrt, use is as an example. saudiqbal.github.io/IPv6/…
    – Saud Iqbal
    Jan 2 at 3:27

1 Answer 1

3

ip6tables accepts a bitmask for the address. Unlike with iptables and IPv4, these bits don't necessarily all have to be at the beginning of the address, so something like this should work fine:

ip6tables -A INPUT -d ::1234:56ff:fe78:90ab/::ffff:ffff:ffff:ffff -j ACCEPT

That would make ip6tables accept all packets going to an IPv6 address that ends in ::1234:56ff:fe78:90ab, no matter the prefix.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .