On 12/20/06, Asfand Yar Qazi <ayqazi@xxxxxxxxx> wrote:
On 12/20/06, Petr Pisar <xpisar@xxxxxxxxxx> wrote: > On 2006-12-20, Asfand Yar Qazi <ayqazi@xxxxxxxxx> wrote: > > On 12/20/06, Petr Pisar <xpisar@xxxxxxxxxx> wrote: > >> On 2006-12-20, Asfand Yar Qazi <ayqazi@xxxxxxxxx> wrote: > >> > I have an ipv6 tunnel on the device 'tunbt6', and another interface on > >> > eth0 to the rest of my network. > >> > > >> > When I enter the following commands: > >> > > >> > ip6tables -N filter6 > >> > ip6tables -A filter6 -m state --state NEW -i ! tunbt6 -j ACCEPT > >> > ip6tables -A filter6 -m state --state ESTABLISHED,RELATED -j ACCEPT > >> > ip6tables -A filter6 -j REJECT > >> > > >> > ip6tables -A INPUT -j filter6 > >> > ip6tables -A FORWARD -j filter6 > >> > > >> > > >> > It doesn't work! I can't even ping6 the machine over eth0 from my > >> > other computer connected to the same ethernet segment! > >> > > >> > >> IP6 uses ICMP6 for link level address resolution (like IP4 uses ARP). > >> Therefore you need to accept NEW icmp6 packets. At least some types. > >> Read draft-ietf-v6ops-icmpv6-filtering-bcp-01.txt (can be found on IETF > >> FTP server) for more detailes. > >> > > > > I'll just let in all icmp6 packets. Now to figure out how to do that... > > > ip6tables -I filter6 -p icmpv6 -j ACCEPT > Yep, figured that out, thanks :-)
Argh - still no luck. I can now ping6 remote destinations, but I can't, for example, establish ssh connections. I can't even ssh to another local box over eth0! To summarise, here's where it stands: ip6tables -N filter6 ip6tables -A filter6 -p icmpv6 -j ACCEPT ip6tables -A filter6 -m state --state NEW -i ! tunbt6 -j ACCEPT ip6tables -A filter6 -m state --state ESTABLISHED,RELATED -j ACCEPT ip6tables -A filter6 -j REJECT ip6tables -A INPUT -j filter6 ip6tables -A FORWARD -j filter6 To force it to let me ssh around to and from my router box, I am forced to do this: ip6tables -N filter6 ip6tables -A filter6 -i eth0 -j ACCEPT ip6tables -A filter6 -i lo -j ACCEPT ip6tables -A filter6 -p icmpv6 -j ACCEPT ip6tables -A filter6 -m state --state NEW -i ! tunbt6 -j ACCEPT ip6tables -A filter6 -m state --state ESTABLISHED,RELATED -j ACCEPT ip6tables -A filter6 -j REJECT ip6tables -A INPUT -j filter6 ip6tables -A FORWARD -j filter6 Anybody know what's happening?
