Christ I hate ipv6, POS it is... OK, steam vented... Folks, I must be doing something wrong, so any pointers be appreciated. I can not even ping6 _OUT_ unless I clear all ipv6 rules or change def policy input to accept, despite it being globally "allowed" already. the machine can also not be reached either despite the ipv6 range included Is there something broken? (v1.4.14) #!/bin/sh /usr/sbin/iptables -F /usr/sbin/ip6tables -F /usr/sbin/iptables -P INPUT DROP /usr/sbin/ip6tables -P INPUT DROP /usr/sbin/iptables -P OUTPUT ACCEPT /usr/sbin/ip6tables -P OUTPUT ACCEPT /usr/sbin/iptables -P FORWARD DROP /usr/sbin/ip6tables -P FORWARD DROP /usr/sbin/iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state INVALID,NEW -j LOG /usr/sbin/iptables -A INPUT -i lo -j ACCEPT /usr/sbin/ip6tables -A INPUT -i lo -j ACCEPT /usr/sbin/ip6tables -A INPUT -s fe80::/10 -j ACCEPT /usr/sbin/ip6tables -A INPUT -d ff00::/8 -j ACCEPT /usr/sbin/iptables -A INPUT -s 207.x.x.x -j ACCEPT / /usr/sbin/ip6tables -A INPUT -s 2a00:1c18:401:c00::531:2 -j ACCEPT /usr/sbin/iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT /usr/sbin/ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT /usr/sbin/iptables -A INPUT -p tcp --dport 25 -j ACCEPT /usr/sbin/ip6tables -A INPUT -p tcp --dport 25 -j ACCEPT /usr/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 1 -j ACCEPT /usr/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 2 -j ACCEPT /usr/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 3 -j ACCEPT /usr/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 4 -j ACCEPT /usr/sbin/ip6tables -A INPUT -p icmpv6 -j DROP #/usr/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP #/usr/sbin/ip6tables -A INPUT -m rt --rt-type 0 -j DROP /usr/sbin/iptables -A INPUT -p icmp --icmp-type 3 -j ACCEPT /usr/sbin/iptables -A INPUT -p icmp --icmp-type 4 -j ACCEPT /usr/sbin/iptables -A INPUT -p icmp --icmp-type 11 -j ACCEPT /usr/sbin/iptables -A INPUT -p icmp --icmp-type 12 -j ACCEPT /usr/sbin/iptables -A INPUT -p icmp -j DROP .. and before anyone asks, yes, IPv4 works perfect :) Thanks -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
