1

The ip6tables command accepts icmp and icmpv6 protocols:

$ sudo ip6tables -A INPUT -p icmp -j ACCEPT
$ sudo ip6tables -A INPUT -p ipv6-icmp -j ACCEPT

However, when I test with the ping command:

$ ping6 fe80::a00:1234:1234:1234%eth1

I never hit the icmp rule:

Chain INPUT (policy ACCEPT 133 packets, 13501 bytes)
    pkts      bytes target     prot opt in     out     source               destination         
       0          0 ACCEPT     icmp     *      *       ::/0                 ::/0                
     112      11488 ACCEPT     icmpv6   *      *       ::/0                 ::/0                

Why is the icmp protocol accepted by the ip6tables if it cannot be reached?

1 Answer 1

3

The protocol is just a number:

$ grep icmp /etc/protocols 
icmp    1   ICMP        # internet control message protocol
ipv6-icmp 58    IPv6-ICMP   # ICMP for IPv6

These numbers share the same "namespace": Internet Procol, some protocols are common, eg: UDP (17), TCP (6), SCTP (132), but others are not, especially when differences between IPv4 and IPv6 matter. That's the case for ICMP: two different protocols.

On a normal environment setup there will never be an IPv6 packet with ICMP (value 1) in its upper layer protocol header. Likewise on IPv4 there should never be an IPv4 packet of type ICMPv6 (aka ipv6-icmp) (value 58). Perhaps some environments using NAT64 could imperfectly leak such packets (ICMP over IPv6 or ICMPv6 over IPv4).

At the same time ip6tables deals only with IPv6: it won't filter at all packets of type IPv4, the same way iptables deals only with IPv4 and won't filters packets of type IPv6.

So the correct way to filter (or here count) both is to have one IPv4 rule and one IPv6 rule each with its correct upper layer protocol.

sudo iptables -A INPUT -p icmp -j ACCEPT
sudo ip6tables -A INPUT -p ipv6-icmp -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.