I have below command
ip6tables -A INPUT -m ipv6header --header hop,dst,route,frag,auth,esp,none,prot --tcp-flags ACK SYN
But getting error as ip6tables v1.8.4 (legacy): unknown option "--tcp-flags"
I have tried --tcp-flags option with iptables, It works fine. But in ip6tables, it gives error
I am familiar with hardening IPv4 on Ubuntu server, but when I use the same rules for IPv6 with ip6tables, the IPv6 connectivity is lost resulting in Destination unreachable: Address unreachable errors during ping. Could you please advise on how to fix this issue? My logic is the following:
#IPv6
#Reset all rules (F) and chains (X)
ip6tables -F
ip6tables -X
#Force SYN packets check
ip6tables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
#Drop XMAS packets
ip6tables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
#Drop null packets
ip6tables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
#Drop incoming packets with fragments
#ip6tables -A INPUT -f -j DROP #this does not really work like in iptables
#Drop traffic
ip6tables -t filter -P INPUT DROP
ip6tables -t filter -P FORWARD DROP
ip6tables -t filter -P OUTPUT DROP
#Keep established
ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#Accept loopback
ip6tables -t filter -A INPUT -i lo -j ACCEPT
ip6tables -t filter -A OUTPUT -o lo -j ACCEPT
#ICMP
ip6tables -t filter -A INPUT -p icmp -j ACCEPT
ip6tables -t filter -A OUTPUT -p icmp -j ACCEPT
#ServiceX
ip6tables -t filter -A DESTINATION -p PROTOCOL --dport PORT -j ACCEPT
#ServiceY
ip6tables -t filter -A DESTINATION -p PROTOCOL --dport PORT -j ACCEPT
#ServiceZ
ip6tables -t filter -A DESTINATION -p PROTOCOL --dport PORT -j ACCEPT
...
Example for ssh server, though I never use the default port 22...
#SSH
ip6tables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
ip6tables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT
The script is made executable, so it runs across reboots in /etc/init.d/scriptname. The idea is to block everything and allow only what is actually known to be used by the server services.
Any better approach, please? Why this works in IPv4, but not in IPv6? When I issue ip6tables -t filter -P INPUT ACCEPT it works, but that's not the point. How do I really secure IPv6 on Ubuntu servers? Thanks!
I am currently using iptables for my home lab router and would like to add IPv6. I have 2 ISPs.
My first ISP assigns a /128 to the interface and the ability to request /56. ISP1 is connected to eno1.
My second ISP assigns a /128 to the interface and the ability to request /64. ISP2 is connected to eno2.
My LAN is enp2s0f0.
How can I get the clients on my LAN to use a ULA IP range that "maps" to the IPv6 ranges assigned dynamically to eno1 and eno2? I am thinking I can use some form of policy routing at the edge to route traffic through each ISP
I have 2 systems A and B linked together using a Strongswan IPv4 IKEv2 VPN. A client (C) connected to A can access the public IPv4 internet via B using the VPN. I am trying to enable C to access the public internet using IPv6 via B i.e. IPv6 packets originating at C are encapsulated by A and sent to B for decapsulation and forwarding.
I believe this is working correctly up to the point where the packet should enter the FORWARD table - but they don't.
On B IPv6 forwarding is enabled
sysctl net.ipv6.conf.default.forwarding
net.ipv6.conf.default.forwarding = 1
When I ping from C
ping -6 -c1 -I fd00::1000 2a00:...:2377
...
1 packets transmitted, 0 received, 100% packet loss, time 0ms
on B using tcpdump I see
14:02:00.014233 IP6 fd00::1000 > 2a00:...:2377: ICMP6, echo request, seq 1, length 64
and on B when using the ip6tables TRACE target I see
Sep 15 14:02:00 host kernel: TRACE: raw:PREROUTING:policy:3 IN=eth0 OUT= MAC=52:54:00:0e:e3:c4:52:54:00:fd:ed:24:08:00 SRC=fd00:0000:0000:0000:0000:0000:0000:1000 DST=2a00:...:2377 LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=24923 SEQ=1
Sep 15 14:02:00 host kernel: TRACE: mangle:PREROUTING:policy:1 IN=eth0 OUT= MAC=52:54:00:0e:e3:c4:52:54:00:fd:ed:24:08:00 SRC=fd00:0000:0000:0000:0000:0000:0000:1000 DST=2a00:...:2377 LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=24923 SEQ=1
Sep 15 14:02:00 host kernel: TRACE: nat:PREROUTING:policy:1 IN=eth0 OUT= MAC=52:54:00:0e:e3:c4:52:54:00:fd:ed:24:08:00 SRC=fd00:0000:0000:0000:0000:0000:0000:1000 DST=2a00:...:2377 LEN=104 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=ICMPv6 TYPE=128 CODE=0 ID=24923 SEQ=1
Using a netfilter flow diagram it appears that packets are getting to the 'routing decision' but no further.
Other than the rules to enable tracing the IPv6 firewall is empty and set to ACCEPT everything.
The system B can ping the target system OK the routing table looks like this
ip -6 r g 2a00:...:2377
2a00:...:2377 via 2a00:..:0:3:1 dev eth0 proto static src fe80::5054:ff:fe0e:e3c4 metric 100 pref medium
Can anyone point me in the right direction to figure out what is (not) going on ?
i just changed to a server with ipv6 and therefore i changed my firewall script. Changing my iptables-script to ip6tables does not seem to work though. This is the ipv6 part which neither allows outgoing traffic nor incoming traffic on ipv6 (but should allow all outgoing, and only allow ssh, https); ipv4 works like a charm :
#IPv6
# Setting default policies:
ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT ACCEPT
# Exceptions to default policy
ip6tables -I INPUT -i lo -j ACCEPT
ip6tables -A INPUT -p tcp —dport 22 -j ACCEPT # SSH
ip6tables -A INPUT -p tcp —dport 443 -j ACCEPT # HTTPS
ip6tables -A INPUT -m state —state ESTABLISHED,RELATED -j ACCEPT
Thanks!
Solution:
iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A FORWARD -p icmp -j ACCEPT
ip6tables -A INPUT -p icmpv6 -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 -j ACCEPT
ip6tables -A FORWARD -p icmpv6 -j ACCEPT
According another answer here and http://www.ietf.org/rfc/rfc4890.txt