I was experimenting with
ip6tables (version 1.6.0) on EC2 instances using Debian 9 AMI, I noticed that after some time I lose connectivity to the server on the IPv6 address while I can still reach the server on the IPv4 address, of course I have the Security Group set to allow all traffic on IPv4 and IPv6 including ICMP.
I'm setting the default policy of the
INPUT chain to
DROP and allowing specific ports or IP addresses and all ICMP traffic, and I'm trying to ping the server from other hosts outside of AWS (from Linode and DigitalOcean), after some time all packets stop reaching the EC2 instance, also I'm running 3 nginx services on ports 80, 8080 and 5555, ports 8080 and 5555 are published ports of nginx Docker containers, but that doesn't matter as I'm trying GET requests on all of these ports with the same issue.
The weird thing is that I'm watching the packets number and when the connectivity is lost, the dropped packets number is not increasing
ip6tables -L -xvn:
Chain INPUT (policy DROP 21 packets, 2748 bytes)
But when I change the default policy to
ip6tables -P INPUT ACCEPT) then it starts working again, I don't know if this is a coincidence or not.
I'm also watching the packets number of the
nat table using
watch -n 1 ip6tables -t nat -L -xvn, when everything is working fine the packets count increases in both the
PREROUTING and the
INPUT chain, one thing I noticed is that when this problem occurs I can see the number of packets increase in the
PREROUTING chain of the
nat table while the packets in the
INPUT chain of the
nat table do not increase, also I don't have any rules set in the
Chain PREROUTING (policy ACCEPT 396 packets, 35498 bytes)
Also I have Docker installed which doesn't use
ip6tables at all, I tried stopping the Docker containers and disabling the Docker daemon and flushing the
iptables rules set by Docker without any luck, the same issue happens after some time.
curl on 3 different servers:
while true; do curl http://HOST_IP:5555 --connect-timeout 10; sleep 1; done
These are the
ip6tables rules that I'm using:
-A INPUT -i lo -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -p ipv6-icmp -j ACCEPT -A INPUT -s IPv6_OF_ONE_OF_MY_OTHER_HOSTS -j ACCEPT -A INPUT -p tcp -m tcp --dport 5555 -j ACCEPT -P INPUT DROP
I'm trying to test that the whitelisted host is able to reach all the ports and the other 2 hosts are only able to reach port 5555.
Am I doing anything wrong ? How can I troubleshoot this issue ?