1

I have a static IPv4 and a static IPv6 address. Right now, my iptables look like:

*filter
:INPUT DROP [28:2168]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [551:134808]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 111.222.333.555/32 -i eth0 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 111.222.333.444/32 -i eth0 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 389 -j ACCEPT
-A INPUT -i eth0 -s 123.4.567.111/32 -p udp -m udp --dport 161 -j ACCEPT
-A INPUT -i eth0 -s 123.4.567.111/32 -p udp -m udp --dport 6969 -j ACCEPT
-A INPUT -i eth0 -s 123.4.567.111/32 -p icmp -j ACCEPT
-A OUTPUT -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT

I tried to use this for my IPv6 ip6tables, but my tries fail - I can't ping google anymore or connect via IPv6 from my workstation.

*filter
:INPUT DROP [28:2168]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [551:134808]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 389 -j ACCEPT
-A OUTPUT -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT

Right now, the machines with the IP addresses 111.222.333.555, 111.222.333.444 and 123.4.567.111 doesn't have IPv6 but I want to roll it out now.

When I change the :INPUT DROP and :FORWARD DROP both to ACCEPT, I can access the machine of course with ssh -6, ping6 and http/https. I use debian wheezy 7.0.2, kernel 3.2.0.

1 Answer 1

4

IPv6 is dependent on a variety of ICMPv6 packets to keep the network functioning. To enable Ping you need a rule like.

-A INPUT-p 58 --icmpv6-type 128 -j ACCEPT -m comment --comment "Ping"

This is a chain that accept the required ICMP types. It was extracted from a Shorewall6 generated firewall. It is accessed with a rule like:

-A INPUT -j AllowICMPs
-A AllowICMPs -p 58 --icmpv6-type 1 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 2 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 3 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 4 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 133 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 134 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 135 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 136 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 137 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 141 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 142 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 130 -s fe80::/10 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 131 -s fe80::/10 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 132 -s fe80::/10 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 143 -s fe80::/10 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 148 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 149 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 151 -s fe80::/10 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 152 -s fe80::/10 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"
-A AllowICMPs -p 58 --icmpv6-type 153 -s fe80::/10 -j ACCEPT -m comment --comment "Needed ICMP types (RFC4890)"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.