12

On my debian 5.0 server, I setup some iptables rules like below:

ACCEPT     tcp  --  eee.fff.ggg.hhh      aaa.bbb.ccc.ddd     tcp dpt:80
DROP       tcp  --  0.0.0.0/0            aaa.bbb.ccc.ddd     tcp dpt:80

aaa.bbb.ccc.ddd is my server's ip address, and eee.fff.ggg.hhh is the other server which is the only one allowed to access the port. I noticed that there is inet6 addr setup on my server, and also netstat shows that apache2 is listening on tcp6 address:

tcp6       0      0 :::80                   :::*                    LISTEN

Do I need seperate iptables rule for ipv6 address? If so, how can I do so? I know nothing about ipv6. Thanks! do I must do so? If I don't use ip6tables, will someone bypass the iptable rule and connect to my :80 port through ipv6 address?

migrated from stackoverflow.com Dec 25 '09 at 2:45

This question came from our site for professional and enthusiast programmers.

11

iptables only filters IPv4 traffic. Rules setup in iptables will not touch ipv6 traffic and thus you should use ip6tables. At the very least you should set the tables rules to default drop. That way only traffic you have explicitly allowed will be available.

  • It would have been nicer to give a reason for the default drop, like Marcin did in a comment to his answer. Still +1. – 0xC0000022L Jan 7 '13 at 16:36
  • @0xC0000022L Do you lock your house when you go out? – Denys Vitali Apr 20 '17 at 0:29
  • Uhm @DenysVitali perhaps a little misunderstanding in that asking for a rationale isn't the same as disregarding or disapproving an advice?! – 0xC0000022L Apr 25 '17 at 13:21
5

You want to look at ip6tables. HERE is a good short script that would demo some basics

  • hmm..my question is, do I must do so? If I don't use ip6tables, will someone bypass the iptable rule and connect to my :80 port through ipv6 address? – Long Cheng Dec 25 '09 at 5:39
  • Do you have IPv6 enabled by default? A lot of distros these days come with it enabled. If yes, then you definitely want to filter out IPv6 explicitly, as IPv6 has a lot of built in connectivity, even if you don't configure it. – Marcin Dec 25 '09 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.