Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Say I have a firewall setup on my linux server with iptables so that I only accept port 22 and port 80 traffic and I block access to all other ports.

Do these rules only work if the client machine is using a IPv4 address? So if an ipv6 address is used, the client can access ports I don't want them to? (ie ports other than port 22 and port 80)

share|improve this question
    
You have not marked any of the answers as usefull. You should do that. ;-) –  Anders Sep 22 at 14:27

2 Answers 2

iptables works for IPv4, but not IPv6. ip6tables is the equivalent IPv6 firewall, and is installed with iptables.

Ultimately, though, iptables is for IPv4 connections, ip6tables is for IPv6 connections. If you want your iptables rules to also apply to IPv6, you have to add them to ip6tables as well.


If you try and replicate your iptables ruleset in ip6tables, not all the rules that iptables can do will port over neatly to ip6tables, but most of them will.

Refer to the manpage for ip6tables if you want to make sure the commands that you use in your iptables will neatly port over.


If you'd like, we can help you create equivalent ip6tables rulesets to match your iptables rules, if you provide your firewall rules list (removing any information that could identify the system of coruse). Otherwise, we can only answer your general question.

share|improve this answer
2  
Isn't this kind of ridiculous then? To clarify, so right now all my ports on the server are wide open to anyone who connects with an IPv6 address? –  user230779 Jan 1 at 21:22
2  
@user230779 I agree it is "ridiculous" but this is why ufw and other firewall managers exist, they add the rules themselves to both, accordingly. The issue at hand here, though, isn't "Can anyone with IPv6 see my site?" the bigger issue is whether your system has IPv6 addresses. Most connections have IPv4 and IPv6 from client computers like mine. But if the remote server has no IPv6 that is public facing, then the IPv4 is connected. As I understand it, though, if you have IPv6 you should add the rules to ip6tables as well. –  Thomas W. Jan 1 at 21:33
1  
@user230779 I could create a script that'd execute the same command for iptables AND ip6tables, and the general rules like -p tcp --dport will still work, but more complex rules might not... (like -j REJECT --reject-with [something]) –  Thomas W. Jan 1 at 21:36
    
Thomas can you link me to a safe ip6tables example for an apache webserver? –  user230779 Jan 1 at 23:51
1  
@Braiam never said anything about the flags. Some of the commands won't work (-j REJECT --reject-with icmp-host-prohibited for example, because the reject packet is a different name in IPv6) –  Thomas W. Jan 5 at 3:24

As others already have told you, there are different firewall tables for IPv4 and IPv6. You could set up rules for IPv6 like for IPv4, but there are a great risk you'll mess it up if you don't know IPv6. Like, you can't drop ICMP for IPv6, as there are essential handshake parts there. Like telling the sender that the frames are to large, etc. Without those things, IPv6 could stop working for some users.

So it would strongly recommend the use of ufw or the package shorewall6 together with shorewall. The iptables frontend ufw supports both IPv4 and IPv6 and works great on servers with one or two interfaces but doesn't route traffic (work as a router or gateway). If you route traffic, you need something better, like shorewall or manually add some rules for forwarding with iptables and ip6tables.

Don't forget that you can have more than one IPv6 addresses on your interfaces. Some are only link local, some are globally static and dynamic. So you should set up rules accordingly and the servers only listening on the right addresses.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.