0

I'm trying to get outgoing IPv6 routing going, my issue is, that conntrack is not working correctly.

I've dumped the traffic via tcpdump, which shows me that the packets go outside (e.g. internal interface -> router -> isp) and that I receive a response (isp -> router).

I do have a general locking rule for all incoming traffic except 443, but I also do have a rule to allow all established or related traffic before:

-A PREROUTING -m state --state RELATED,ESTABLISHED -j ACCEPT
-A PREROUTING -i eth1 -j lockout

If I remove the locking rule, everything works as expected, but then I cannot block any other traffic going via the router.

When looking at the output of conntrack -L -f ipv6 no flows are listed there.

The modules are loaded:

lsmod shows:

nf_reject_ipv6         16384  1 ip6t_REJECT
nf_conntrack_ipv6      20480  3 
nf_defrag_ipv6         36864  2 openvswitch,nf_conntrack_ipv6
nf_conntrack          110592  10 ip_vs,nf_conntrack_proto_gre,openvswitch,nf_nat,nf_nat_ipv4,xt_conntrack,nf_conntrack_netlink,xt_connmark,nf_conntrack_ipv4,nf_conntrack_ipv6

Kernel version:

Linux router 4.3.3-1.el7.elrepo.x86_64 #1 SMP Tue Dec 15 11:18:19 EST 2015 x86_64 x86_64 x86_64 GNU/Linux

OS:

CentOS 7

Am I mistaking something or it just not working? Where could I look to find what's the issue?

4
  • Why are you trying to put things into a PREROUTING table? Nov 17, 2016 at 19:09
  • I completely lock out traffic directly on the router before it's getting anywhere. Oh, I didn't mention that it's in the mangle table. I don't actually try todo that, I just want that iptables recognizes connections like on ipv4, where this works fine. Nov 17, 2016 at 19:26
  • As told Thomas why don't you block traffic in the filter FORWARD and or INPUT rules like on ipv4? Beside, is lockout also dropping ICMPv6? For example, NDP, being ICMPv6 is part of IPv6, unlike its equivalent ARP which isn't technically part of IPv4 (and not blocked by iptables). There are several ICMPv6 packets required to be accepted by a host and by a router.
    – A.B
    Nov 21, 2016 at 22:46
  • Because I don't want to add the rules twice, it doesn't matter where to lock it, the point in case is, that connection tracking works for IPv4 and doesn't for IPv6. If you can give a good reason, instead of "why", then I may consider switching it, but as it stands it works for ipv4. (it's the SAME!) The issue is not that ARPv6 or anything else is blocked, but that the connection tracking isn't working e.g. RELATED,ESTABLISHED is not matched. Therefore no outgoing connection works. The lockout table contains an ACCEPT for port 443, so incoming connections work fine Nov 22, 2016 at 13:20

0

You must log in to answer this question.

Browse other questions tagged .