2

I have been struggling getting ip6tables to work. It is for a CentOS 6 server running DirectAdmin, hence the ports.
Could someone please tell me why it does not allow any traffic?

Any input on this is highly appreciated, as I am stuck at this for days now.

/sbin/ip6tables -F
/sbin/ip6tables -t mangle -F
/sbin/ip6tables -A INPUT -i lo -j ACCEPT
/sbin/ip6tables -A OUTPUT -o lo -j ACCEPT
/sbin/ip6tables -P INPUT DROP
/sbin/ip6tables -P OUTPUT ACCEPT
/sbin/ip6tables -P FORWARD DROP
/sbin/ip6tables -t mangle -P PREROUTING ACCEPT
/sbin/ip6tables -t mangle -P OUTPUT ACCEPT
/sbin/ip6tables -X
/sbin/ip6tables -t mangle -X
/sbin/ip6tables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
/sbin/ip6tables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
/sbin/ip6tables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
/sbin/ip6tables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
/sbin/ip6tables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
/sbin/ip6tables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
/sbin/ip6tables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
/sbin/ip6tables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -m state --state INVALID -j DROP
/sbin/ip6tables -A INPUT -i eth0 -s aaaa:bbbb:cccc:dddd:: -j DROP
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 80 -m connlimit --connlimit-above 10 -j DROP
/sbin/ip6tables -A INPUT -i eth0 -s 0:0:0:0:0:0:0:1 -j DROP
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 20 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 21 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 35000:35999 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 25 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 587 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 53 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p udp -d aaaa:bbbb:cccc:dddd:: --dport 53 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 80 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 443 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 110 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 995 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 143 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 993 -m state --state NEW -j ACCEPT
/sbin/ip6tables -A INPUT -i eth0 -p tcp -d aaaa:bbbb:cccc:dddd:: --dport 2222 -m state --state NEW -j ACCEPT
Improve this question
0

1 Answer 1

Reset to default
4

Try allowing icmpv6. (for testing, just add "ip6tables -I INPUT -p icmpv6 -j ACCEPT").

In IPv6 you really need alot of ICMPv6.

Here is the rfc.

Improve this answer
4
  • Thanks a bunch, that solved the issue. I have now added it like: /sbin/ip6tables -A INPUT -p icmpv6 -j ACCEPT under /sbin/ip6tables -A OUTPUT -o lo -j ACCEPT Is that the best way of doing so?
    – Xen
    Jun 5, 2012 at 15:16
  • It will work with that, but to be secure, you should limit pings, etc. The rfc has an appendix (b) at the end, with commented ip6tables example rules, which you should review.
    – mulaz
    Jun 5, 2012 at 15:20
  • Enlighten me please, do you mean filtering by type like --icmpv6-type echo-reply?
    – Xen
    Jun 5, 2012 at 15:33
  • 1
    This is just one example. You need to let all neighbour discovery packets, router advertisments, packet-too-big, exceeded ttls, etc. You can leave it at allow-all (-A input -p icmpv6 -j ACCEPT), and it will work. If you wish to limit things, then you should read the rfc, what you can limit, and what not, and depending on your network size and equipment, what the limits are. If you don't have ipv6-enabled switches, or even dumb-switches, you will get alot of multicast icmps 'broadcasted', and the limits will need to be alot higher. It all depends on your needs and enviroment.
    – mulaz
    Jun 5, 2012 at 15:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .