Home / server / Questions / 1029545
Accepted
sunknudsen
Asked: 2020-08-11 07:35:29 +0800 CST

How to write iptables rule to accept certain ICMPv6 types and codes?

  • 772

I currently have the following:

ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 1 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 2 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 3 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 4 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 128 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 129 -j ACCEPT

For ICMPv6 type 3, I would like to only accept code 0.

For ICMPv6 type 4, I would like to only accept codes 1 and 2.

This is based on RFC 4890.

iptables

1 Answers

  1. Best Answer

    The man page for iptables-extensions(8) says:

       icmp6 (IPv6-specific)
       This extension can be used if  `--protocol  ipv6-icmp'  or  `--protocol
       icmpv6' is specified. It provides the following option:

       [!] --icmpv6-type type[/code]|typename
              This  allows  specification  of  the ICMPv6 type, which can be a
              numeric ICMPv6 type, type and code, or one of  the  ICMPv6  type
              names shown by the command
               ip6tables -p ipv6-icmp -h
    • 2