I'm trying to get outgoing IPv6 routing going, my issue is, that conntrack is not working correctly.
I've dumped the traffic via tcpdump, which shows me that the packets go outside (e.g. internal interface -> router -> isp) and that I receive a response (isp -> router).
I do have a general locking rule for all incoming traffic except 443, but I also do have a rule to allow all established or related traffic before:
-A PREROUTING -m state --state RELATED,ESTABLISHED -j ACCEPT
-A PREROUTING -i eth1 -j lockout
If I remove the locking rule, everything works as expected, but then I cannot block any other traffic going via the router.
When looking at the output of conntrack -L -f ipv6
no flows are listed there.
The modules are loaded:
lsmod shows:
nf_reject_ipv6 16384 1 ip6t_REJECT
nf_conntrack_ipv6 20480 3
nf_defrag_ipv6 36864 2 openvswitch,nf_conntrack_ipv6
nf_conntrack 110592 10 ip_vs,nf_conntrack_proto_gre,openvswitch,nf_nat,nf_nat_ipv4,xt_conntrack,nf_conntrack_netlink,xt_connmark,nf_conntrack_ipv4,nf_conntrack_ipv6
Kernel version:
Linux router 4.3.3-1.el7.elrepo.x86_64 #1 SMP Tue Dec 15 11:18:19 EST 2015 x86_64 x86_64 x86_64 GNU/Linux
OS:
CentOS 7
Am I mistaking something or it just not working? Where could I look to find what's the issue?