0

I was experimenting with ip6tables (version 1.6.0) on EC2 instances using Debian 9 AMI, I noticed that after some time I lose connectivity to the server on the IPv6 address while I can still reach the server on the IPv4 address, of course I have the Security Group set to allow all traffic on IPv4 and IPv6 including ICMP.

I'm setting the default policy of the INPUT chain to DROP and allowing specific ports or IP addresses and all ICMP traffic, and I'm trying to ping the server from other hosts outside of AWS (from Linode and DigitalOcean), after some time all packets stop reaching the EC2 instance, also I'm running 3 nginx services on ports 80, 8080 and 5555, ports 8080 and 5555 are published ports of nginx Docker containers, but that doesn't matter as I'm trying GET requests on all of these ports with the same issue.

The weird thing is that I'm watching the packets number and when the connectivity is lost, the dropped packets number is not increasing ip6tables -L -xvn:

Chain INPUT (policy DROP 21 packets, 2748 bytes)

But when I change the default policy to ACCEPT (ip6tables -P INPUT ACCEPT) then it starts working again, I don't know if this is a coincidence or not.

I'm also watching the packets number of the nat table using watch -n 1 ip6tables -t nat -L -xvn, when everything is working fine the packets count increases in both the PREROUTING and the INPUT chain, one thing I noticed is that when this problem occurs I can see the number of packets increase in the PREROUTING chain of the nat table while the packets in the INPUT chain of the nat table do not increase, also I don't have any rules set in the nat table.

Chain PREROUTING (policy ACCEPT 396 packets, 35498 bytes)

Also I have Docker installed which doesn't use ip6tables at all, I tried stopping the Docker containers and disabling the Docker daemon and flushing the iptables rules set by Docker without any luck, the same issue happens after some time.

I'm trying ping and curl on 3 different servers:

ping6 HOST_IP

And:

while true; do curl http://HOST_IP:5555 --connect-timeout 10; sleep 1; done

These are the ip6tables rules that I'm using:

-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -s IPv6_OF_ONE_OF_MY_OTHER_HOSTS -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5555 -j ACCEPT
-P INPUT DROP

I'm trying to test that the whitelisted host is able to reach all the ports and the other 2 hosts are only able to reach port 5555.

Am I doing anything wrong ? How can I troubleshoot this issue ?

1

After some testing I figured out the problem, and when I enabled DHCPv6 client port 546 using:

-A INPUT -m conntrack --ctstate NEW -m udp -p udp --dport 546 -d fe80::/64 -j ACCEPT

Everything started working normally, also I tried removing this rule to make sure this is the real problem and yes indeed when this rule is removed these packets are dropped and I lose connectivity to the server on the IPv6 address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.