Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I configure ufw to only allow outgoing/established connections for a IPv6 network?

I am using an old computer with 12.04 installed to create an IPv6 router for my local network. I would like it to act as a firewall as well.

I have a tunnel setup and working with Hurricane Electric and the computer is successfully routing traffic to and from the IPv6 Internet.

I have followed the instructions given at under the “ufw and Routing” section.

Unfortunately, when I enable ufw, all connectivity is lost.

I'm also not sure what is meant by

If you only want outgoing connections you also need to change DEFAULT_FORWARD_POLICY="DROP"

Does that mean change it to equal “DROP” or change it to equal something else?

iptables -l









share|improve this question
Can you show the ufw config files instead of ghe iptables rules? – Sander Steffann Apr 5 '13 at 22:25
@SanderSteffann Done – Corey Apr 6 '13 at 16:30
I re-asked this on Server Fault.… – Corey Apr 10 '13 at 22:40

You need to add rules so that the tunnel traffic is accepted on your external interface. You already allow outbound traffic by default, but because the input default policy is to drop you lose all your tunnel traffic.

Try something like this in user.rules:

-A ufw-user-input -p 41 -s <remote tunnel endpoint> -d <your IP address> -j ACCEPT

This rule allows protocol-41 (also called 6in4) packets from to . Protocol-41 is the protocol used for HE (and many other) tunnels. If you don't include this rule then the firewall will drop (default action) these packets, and you will never receive anything over the tunnel.

share|improve this answer
here is my edited user.rules – Corey Apr 8 '13 at 13:38
does that look right to you? would you mind explaining in your answer what each part of that line does? – Corey Apr 8 '13 at 13:39
Looks right if w, x, y and z match your tunnel setup :-) – Sander Steffann Apr 8 '13 at 13:51
So now I can enable the firewall with "ufw enable", and I can ping out to the v6 Internet. However, when I use the IPv6 Portscan feature in the portal and scan the v6 address of an internal Windows box, I get the following. – Corey Apr 8 '13 at 14:29
I would like to firewall any access from the outside unless it’s a response to an internal request. Is my understanding flawed somewhere? – Corey Apr 8 '13 at 14:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.