7 votes

What are the essential iptables rules for IPv6 to work properly?

The essential rules will depend on the network as a network might instead use SLAAC instead of DHCPv6, or there can be other complications depending on tunnels, ICMP handling, etc. -A INPUT -m ...
thrig's user avatar
  • 34.9k
7 votes
Accepted

Why do we need to have an ip6tables rule for DHCP6 to work? (by contrast, IPv4 does not require any)

In DHCPv4, the initial discover/offer/request/ack exchange happens using broadcast addresses, and is initiated by the client, so iptables connection tracking has no problems following it on the client....
telcoM's user avatar
  • 96.9k
6 votes

What are the essential iptables rules for IPv6 to work properly?

I looked for examples in ufw, the firewall created by Ubuntu. It seems that once you've allowed both ICMP and DHCP, there's not much else left to worry about. https://git.launchpad.net/ufw/tree/conf/...
sourcejedi's user avatar
  • 50.3k
6 votes
Accepted

ip6table-restore failed in Debian buster/sid

You are most certainly running iptables over nftables, as this is the default on Debian buster. To confirm this is the case, check for (nf_tables): # ip6tables-restore --version ip6tables-restore v1....
A.B's user avatar
  • 36.6k
4 votes
Accepted

Help with IPv6 rules and ip6tables

Let's see what your rules are trying to do first, to see why they might not be working: -A INPUT -i lo -j ACCEPT All traffic arriving at the loopback interface will be processed, including ICMPv6 ...
ErikF's user avatar
  • 4,057
3 votes
Accepted

How do we access the "icmp" protocol in ip6tables?

The protocol is just a number: $ grep icmp /etc/protocols icmp 1 ICMP # internet control message protocol ipv6-icmp 58 IPv6-ICMP # ICMP for IPv6 These numbers share the same "...
A.B's user avatar
  • 36.6k
2 votes
Accepted

How to convert iptables rules to ip6tables rules?

Ok, it seems that adding the following two rules helped. -A INPUT -p udp -m udp --dport 546 -m state --state NEW,ESTABLISHED -j ACCEPT -A INPUT -p ipv6-icmp -j ACCEPT Here the complete rules.v6 # ...
Dr3w Br1ck13's user avatar
2 votes
Accepted

ip6tables will not accept -d destination but iptables will

IPv6 can not connect to an IPv4. in ip6tables everything needs to be ipv6
Brént Russęll's user avatar
2 votes
Accepted

Are there any disadvantages or hazards to load all the firewall rules before loopback interface is initialized?

There is no guarantee that lo is initialized first (it may happen to be configured thusly right now, but that doesn't mean it has to be that way and it may indeed be changed at some point in the ...
Wouter Verhelst's user avatar
1 vote
Accepted

Meaning of fields in ip6tables logs

The link you shared is for IPv4, you are working with IPv6. So you need to google, the IPV6 documentation. In short: HOPLIMIT - Hop Limit - functional analog of Time To Live TC - Traffic Class - ...
White Owl's user avatar
  • 5,129
1 vote

iptables mangle

The command changes DSCP field to 26 of each packet leaving the computer with that command active, and coming from addresses 1955:1890:1401:24FF::/64. iptables can manipulate packets on INPUT, FORWARD,...
nobody's user avatar
  • 1,710
1 vote

how to check whether an ipset was hooked up to iptables

The ipset has a reference counter built-in. So whenever it's referenced by iptables, its references counter gets increased. As far as I know, only ipset's meta set list:set and iptables reference an ...
A.B's user avatar
  • 36.6k
1 vote
Accepted

Why after some time I lose connectivity to my host on IPv6 when using ip6tables?

After some testing I figured out the problem, and when I enabled DHCPv6 client port 546 using: -A INPUT -m conntrack --ctstate NEW -m udp -p udp --dport 546 -d fe80::/64 -j ACCEPT Everything started ...
Pierre's user avatar
  • 1,083
1 vote

ipv6 security on internal network

IPv6 (apparently) does not support NAT. The standards folks strongly discourage IPv6 NAT but that doesn't prevent people from implementing it. There is no fundamental difference that makes IPv6 NAT ...
plugwash's user avatar
  • 4,352

Only top scored, non community-wiki answers of a minimum length are eligible