does anyone have a solution to make reverse path filtering work (in loose mode) also for IPv6 and not only for IPv4?
The setup I am having is a machine1 connected directly to a machine2, while machine1 being also connected to outside net.
The targetted traffic is this: Client (from the outside net) sends a request to the machine1 which then forwards the request to the machine2.
Obvious problem: When packet gets handled by machine1, it forwards it to a port connected to machine2, but with source IP of a client. This would normally be seen as a spoofed ip - but that's what rp_filter is for, right?
Normally on machine1 I would do (for IPv4):
echo 2 > /proc/sys/net/ipv4/conf/<interface_to_outside_net>/rp_filter
and everything would work, but for IPv6 this is not the case since rp_filter is not implemented in the kernel for IPv6 as of yet.
The only solution I know of would be to set up ip6tables.
ip6tables -t raw -N RPFILTER
ip6tables -t raw -A RPFILTER -m rpfilter -j RETURN
ip6tables -t raw -A RPFILTER -m rpfilter --loose -j ACCEPT
ip6tables -t raw -A PREROUTING -j RPFILTER
But for some reason traffic never reaches machine2 and on the client side I get timeout.
Using tcpdump on machine1 I get only the SYN of TCP handshake.:
14:18:50.390292 IP6 fd11:3456:789a:1::4.34184 > fd12:3456:789a:1::1.1111: Flags [S], seq 701159610, win 28800, options [mss 1440,sackOK,TS val 6066549 ecr 0,nop,wscale 7], length 0